8c6fca9f3220719e8ec10cd61daa204735c7ff30c169f85abe5dc603ad7d2662

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe
Size 1.2MB
Sample260415-sr454ady91
SHA256 8c6fca9f3220719e8ec10cd61daa204735c7ff30c169f85abe5dc603ad7d2662
MD5 c56f898ce7c005a9b2664263f950239c
SHA1 dfbd0d695f5c8c1c8a7228283d43e8b4e4bc3a08
SHA512 15852acf53514d091f7705cc29cc2ca7981e75b67e9afb0c68af0d999c0670a722dc7cf4bd1d5ac45c7d61c43b3d0f92009b9b3568328f7b24dd32284b890687
SSDEEP 24576:lDIiukOiFOPfepJ1HeCtsO8e7zYdyxknw4FYnshx8OfVe247:NgAHeQJPx4x8EVep
TLSH
T114459C4663EC42E4F1F7AA3999724146EB72BC524B35C2CF0254566E1E73AD08D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5248	alg.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
2716	elevation_service.exe
3536	elevation_service.exe
4336	maintenanceservice.exe
3268	OSE.EXE
5236	fxssvc.exe
1040	msdtc.exe
560	PerceptionSimulationService.exe
2960	perfhost.exe
6008	locator.exe
2328	SensorDataService.exe
3220	snmptrap.exe
3600	spectrum.exe
2668	ssh-agent.exe
5504	TieringEngineService.exe
236	AgentService.exe
4760	vds.exe
5272	vssvc.exe
2160	wbengine.exe
3016	WmiApSrv.exe
2556	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a4688a4bda180f68.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067981613f2ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a6c8b13f2ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9816013f2ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f05ffc12f2ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000980b4b13f2ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
1992	DiagnosticsHub.StandardCollector.Service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	652	2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1992	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2716	elevation_service.exe
Token: SeAuditPrivilege	5236	fxssvc.exe
Token: SeRestorePrivilege	5504	TieringEngineService.exe
Token: SeManageVolumePrivilege	5504	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	236	AgentService.exe
Token: SeBackupPrivilege	5272	vssvc.exe
Token: SeRestorePrivilege	5272	vssvc.exe
Token: SeAuditPrivilege	5272	vssvc.exe
Token: SeBackupPrivilege	2160	wbengine.exe
Token: SeRestorePrivilege	2160	wbengine.exe
Token: SeSecurityPrivilege	2160	wbengine.exe
Token: 33	2556	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2556	SearchIndexer.exe
Token: SeDebugPrivilege	2716	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
652	2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe
652	2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe
652	2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2848	2556	SearchIndexer.exe	104
PID 2556 wrote to memory of 3404	2556	SearchIndexer.exe	105
PID 2556 wrote to memory of 2604	2556	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_c56f898ce7c005a9b2664263f950239c_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:652

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5248

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4000

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5236

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1040

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:560

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6008

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2328

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3220

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5216

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5272

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2848
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2852 2840 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3404
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2828 2832 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0650440035aa3301d59504c3c9cc00c8c6ea7af4806e1b1452d0a95ba921192f
MD5 7caccf30a9cff4aae911eebf0c60439f
SHA1 8ed6769d7d6b05b13fcfd84b3eca526b4d13632f
SHA512 c626e3dec6f00bf2431a28115eb05ffa1e0351cfd147ecbd604ac1f13dc1b43f676cca650008c935bfdf3a42bbc34b2a3f69378d3ff9225465bddffb78758454
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnwx4x8EVep:P3q6HjBzix8EVy
TLSH
T18CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 faf9d88eabc91b9f05f318b2a27e875d8edb30bfe176e7b1ac669186195de35a
MD5 a44c68facf388b30ad388a1ba0974c68
SHA1 c0f7be8066a619e583fc890544dfbb13398a3acb
SHA512 583b24a4c0db5e6b6a1e7bd036327af9ca339d73f889de3bba3673213ff13472c03036252c4957a506ca850a9a6957a28db0774a27a655e4971d42ed91550d31
SSDEEP 12288:d1XLsswWkxy2lRq2czAc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:TXYfDtczAcyxknw4FYnshx8OfVe247
TLSH
T10475F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 3087409f7749e0da713e1dd9f77f869e5bf2078ec33ef7a6c8719ccfa2b84f57
MD5 3865b71849edd3530dfa9137d3195c26
SHA1 20c79fad4858eeeccd192ac81340b310f8f66fb8
SHA512 08f8e0f9dcc70c8eebc4030f3ba5b6b1607b8a51a8a37668bd8f52874032fddd4ffb0bcc9ec283f703a863e9b7f9093cb19449159707c1e120a125458659b5e7
SSDEEP 24576:x0Le5ji0hmx1rMdyxknw4FYnshx8OfVe247:xPji0A7xx4x8EVep
TLSH
T12395AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d08f8fceb8a6efb482644a6de14223f6f6a369ee0d71d39ce036b08cf634f61
MD5 24720fca422afdbdbe4964cda1b30b9b
SHA1 478eabd73fed3f1619774d824f044da608a6b17d
SHA512 0714436d375626e65c3917ad57a0f4385a202f50663e6eb2cb81f340ab1c791b6ee5c79f570a66d0446e7c37bf4a6a03ab7570e836dce7a9708bd9d7ff45c899
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyuryxknw4FYnshx8OfVe247:c/ezSC6vUzPvxHjy1x4x8EVep
TLSH
T1B5756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 57cbedde822427ac46b31c0bd3f0993a71ecd1db144a936e88327d7441e918d0
MD5 7b9258171ede5765ad83ace7f1fb80d5
SHA1 1388f918901959bed413d26a287a981c56c2f2c7
SHA512 3d257dc87609ba5369dd02bcffee6d1a6e486dacb387317d42f25bc4a6ebd65b818a6ce12143b6380190e243d04b39cfaddf424ec8fd5cf02558a82b8a44f6ef
SSDEEP 24576:uVbqPb88hv/l+6Ayxknw4FYnshx8OfVe247:uVO88hXl+Mx4x8EVep
TLSH
T15B559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6343e60f30e67c7faf7a70ac4cb847b24632940982d7b05ed740b302ee14c458
MD5 155c614e69b3b41276adece58a6a9c9d
SHA1 ddfab6b76b3f9f000e8cba81f9b837575e9e2a11
SHA512 4f5bdaf7db81ca92b52b82ec31526ef65a63636505a12d2746f474b21d7c9c410f3af340e7a794631cb6c82b527252df28fb2075895c5603acc2dd86394445ce
SSDEEP 12288:TNR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TNRyxknw4FYnshx8OfVe247
TLSH
T1AD65237CA7DDA4E1FA5E15331B7572622616BDA0DA74C11BCB78B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 cc59c6fc3bb89e65563f589ca1ae71b6b06bf8267c6d7b87138cab12d3b70bf5
MD5 42efac7af8590015739b8a63297bbb74
SHA1 8949240b6771ee980ea0e5a79fed021865667a15
SHA512 75e3f0985da2eabbb45e6119f599e1ca4b6dba94b72737406ed3bf915973e023ec275ef1f90288f3c3e7ee12d282deb7dd5fab95859cbe258bc86805f7ef27fc
SSDEEP 12288:KeBNUbTVO86U4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KJIU4yxknw4FYnshx8OfVe247
TLSH
T15375CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 92012efb78e3680f96c73fe3e95df98027e7c755cb936721748dcce962ce1432
MD5 0569da59af75de405722ec892cab1b2e
SHA1 894e071d6558303251c7dbcfde1d906f8f494852
SHA512 0a4a3e0b93b95fc4f3ccc6796275cad0cc285e4518ed08fddb10f0bd58b3434d2e7ae7e8d98dff929503291bef5ce17fb27ab0933e205f516a891c0df4c21281
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:YQvGAdlCEL8c/yRNw5Ceix8EVy
TLSH
T172267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 368ca7fbdef8ab43c6f04277f7797c2992bb877e8277b9a96d705824069d5393
MD5 e236d0e4b1e25c41d4ffd4cd7c9df0ac
SHA1 ad74cf0a7bfc9c523aed90dddd3ec598b7ed6b74
SHA512 938c1392cb14748a2b86baddb3901dd68a4c903655670f99d3027f4b057383300af4a592fbca0a7b999e69ddc77363caefc022ae5223b79704ffaa0a4d3b3d24
SSDEEP 12288:uAwSfxL/2Dc3LDLLmt0LDQewsAjO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:T6ewsAjOyxknw4FYnshx8OfVe247
TLSH
T11185E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c65d137bcff8c852df9c8ae73c7c0520c183734d56d8a771770bf7978a2eb6da
MD5 0f46d4914548b91cef9f36f0c53b4383
SHA1 93e32dd8b6d5b8dadb94d2ecc76fa97eb22f0fae
SHA512 ce663bdfaf103cf9c583f0701e1a1baa383df524f5d7120ead5b936ea8abffa2592345d913a699b0705b68f425bea3bb6f400b42717653c472b4c42b4dbbc902
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH0:tUEtQevvqc2W1cpV2EI32
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 04dd80322e6caecb9aae2c0606615c2643bb63c41774d787048066234b5081f6
MD5 ffa584a751fd18ece32ca4e1cd6c98b6
SHA1 7ab41b39eba67382d7246bd8953c4d3965b4e1eb
SHA512 2ecb47b9ae46118ba799c27037deca16893c815b6c29358298a7eb07cd825390f2bf024b309bbd98b9c117d5970c70c7af39bc64c9eb024ddf19be891d2145f5
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/zhx4x8EVep:qoqtVjnmCix8EVy
TLSH
T18FD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0ba215625f30698a7f863cb341bc235afb7b0a5de269c1c0824ca3ab9d674d22
MD5 5a7ae4c59b1544e5427bf57504759cff
SHA1 9fa5bd3f53f3e5d3194d80f20e811ccd085b04ef
SHA512 fbf27f1793656f4e0a05da3ed868b3de892ecc478407cf1c5d11833df21626f6d1caee2e300c64e48d22cd9e632315b0b0b1919a288673f2aee652ccd0db6945
SSDEEP 24576:TAhGLJIFoiwtA5l7S53Xyxknw4FYnshx8OfVe247:TAMyFoiq5Sx4x8EVep
TLSH
T1DA35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 36cccb607e52e531a91393d8874f84e776928571b85692700e8fdafec04ef51e
MD5 40fbfb3d70c1dd1aff0c06e60a0161a7
SHA1 d6d0ff41f43e21c974f06494f7f7a0a9aa4d9eaa
SHA512 a9fe55363863300057a2c317943d698159a742891cb125526bf7e10c3449ba204a9ef1cd23d0df215d944650732953c0c2beb7ff2a1b4a8b2c7e21d0cab09abb
SSDEEP 12288:emw5HEjsChN4BFgl0WDm+CL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:3wuVOW6yxknw4FYnshx8OfVe247
TLSH
T18E75F14977E91CF9E96741398697C132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 a05e97a68f9e3418daa71ec95df3083800e64db7ce9d032385653290a73d73b2
MD5 c2ae7ec72a8178b541127929f02deb99
SHA1 5a1722b647a773889a692c37770772579f83f29b
SHA512 8b9ccca1f68a5d874b5a053464e9d8cdb177380a007b39239ccd3e149183246817560eeb0e35e570d0b49689803e2693ed40d25be472f96dce81beb211681ae1
SSDEEP 12288:HFZ1Iye+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lZu1yxknw4FYnshx8OfVe247
TLSH
T1CE6512AC33E860F1E1A7113A89F15205E77274A2677183CF4768625EAE72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 26c9d5cc60d5a39ea07b32e067fc8a9df627167bd5f9fbefb0e85ceb922b5501
MD5 66e24b6c9ae8a25d07d05d11ae53b0cb
SHA1 4d96a1d959f76ca32f20c46388fa4bd9929b0708
SHA512 6d0dde29a4332559c4db8f654188ff3a9e78a13875403fa94082651ce3c37b23d8d0ea6001f745b7a9850062335640a0f9a47b2cb3147928fe2cf979568f053e
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:OQRQyi36YOcPQLvw2gAf+PN3Pix8EVy
TLSH
T1D5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 91eeeca47673feef2819eee29e219a0bdd66586809bc11756ac5a657be605e43
MD5 4cf074ce856ddf0efbb87041fb9ef64a
SHA1 e82f7743b587852378289dd5514f103b8d3e30d2
SHA512 44b007fc427fa57671ad618627d94d8a1ff75845fddbf5b5dd75b12029dadae70bc76fed482bac6eaf626901e56778f79dd350b63b89a41726beb3c390739e31
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:QQRQyi36YOcPQLvw2gAf+PN3Pix8EVy
TLSH
T12C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff61098b6a65c6a05b09772997ae2bb231cabaf7c0d943a9349b76377b7797bd
MD5 79bf97aed872268ec6e2fe47efdeb640
SHA1 cb2ddc13a95d69546b50c91b40de61ea0a8d9e38
SHA512 62ce6df4c6cb38a9de36515cf3746566d58b2f7485822d6273250ff4cef89d6eb4e5f3ac7f4aafe19818c73c915094105a4fa35fdffc789a6c7d8b48ed4ee843
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0lyxknw4FYnshx8Z:s68Qg55nhheWu7PNU3/xx4x8EVep
TLSH
T1BDB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4bca77bdb6f7813ac85a2cbf9ec1e24fbf3bccc4080122eb4125de45d6be6b68
MD5 6ad733797bb01262664025c6bdf6a545
SHA1 f9dcb075598bad2c9883306c347dad529f639485
SHA512 662cb76fa92a1d00e2b8aff56f668b44a35eb44c945eb07fb8778ea48c3059484914b41a0959fe3296215d867feafa9f5b4c8e7734907c4255e9f85e16df0cc7
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99R:Jy5112gYy5azzVvL69nLKnhZUix8EVy
TLSH
T11B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 209676120192eaa02558599ae11af8a8d821f2aa9a0d21207b0a715c2eddabf2
MD5 4459fa2439deba51a62a72d91165c6a2
SHA1 f5aa8cdf2ff8638eb6c5d91ee8ed7e10848e860a
SHA512 cdee9f8b2d9621df10d8b9c2fcc8eff8d5cafc00d2e3b47dc403f57f12dd2280eff361b1d42bc7da3ae114b53a3ff9c1e4cc37921492883dd5c29732d3f69a6c
SSDEEP 49152:WB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnx4x8EVep:ku6JmVxd2dnix8EVy
TLSH
T157D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 02aa8b79bdc792611680f8973da72d6c98c32747eda595aaa4246858a5c4e75f
MD5 36dc23f83ca56a0560d960667054dcfc
SHA1 01333b2630ff4ab17ca8242225bc7aabe108e64d
SHA512 225d1c7229588c4e111bf03e2555537920e96c12c3745c9a2ec3f30adf103ad1e752f518bd0595063a9cb7ac014a8931cd21159e1cac9e2aca8318338b6ab977
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4x7x4x8EVep:wmifPbRCix8EVy
TLSH
T1B8B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8a372adaf60af9bf1297b3ef3b445570544b7998495cc261183d854a1205bf9a
MD5 d6fec681f9adcc5640e0cf2fbe6fae91
SHA1 ed20cfa3761eae5e8d9358f9ef41fb40bcc30ae8
SHA512 eaf570273cb70800993182c84404177842bcf8d549ff57c8985c3e756d796425b9dede939a4da9a733c60b1a1254324d3093093eb116caa03ccffb7e5e78bd85
SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHqAx4x8EVep:W5dKTi61Aix8EVy
TLSH
T100C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4a6bc0a8884dab6906ac6372901448083ffb62cede06f4b76e1840076991ea00
MD5 d7b31e14039c0cd4cfef7d7a3d46b935
SHA1 c1ff0e42b8effa43c9a03f5c2d634b037b611c4b
SHA512 54e40f05eda8df718ea5c30736345e79416ebef8fb952ea915eb4a4860a7cf3bc3a4d5f13c67e4c110292cd658157db465eff8a166fa4ee7f52436d3d7d65aef
SSDEEP 49152:whtSn8EApI0figngiDn0AP5w3x4x8EVep:hX2iyphmix8EVy
TLSH
T1CA95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 33e44a1ec6284933269bf337f03f262d639ec06a9c91f5be175ef59eecff3fe1
MD5 51544f549173ca46842c7d5cfc4e5f6d
SHA1 048888210449d7caeb88819f3c47c04b52a36fc7
SHA512 6ae54f6a3e0943cb3453474ea837d2a8467887d4eb3dc154c74f612a5eb6254271eb69e4790910239b1160ba47659b46acd22e03cc94f51291b2d94a0ce121dd
SSDEEP 12288:4J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4Jyxknw4FYnshx8OfVe247
TLSH
T1AC65237CBBDEA5E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 bae6d0d8b56011a8eef0cc114512651a2983fb7d3cfd95d7c65d73353a9ec560
MD5 0256e61f850ba9201f99091455055ff3
SHA1 b4960fb65880c8a2daaa9e14e89f4ee6d6029c85
SHA512 8cc08150e16f12a2d4e574536d2c22bc12491f933b26ea8cbbca66045751234cdfbf3ce7b2a92c8edd8e7aad3a9eaa8576135c79515dc9a26e3f3793885bc19b
SSDEEP 12288:Bi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Biyxknw4FYnshx8OfVe247
TLSH
T11F65237CBBDA95E2F50D11734B7172626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1eb70dedf803067f893bf2d1db6c7d78c8b57ab4493b8c3a55e98e583ba9a152
MD5 e7ecf7967565ecd9f4940aee38870e59
SHA1 9060c598b755b37fe2820c1f5a3282156b48c500
SHA512 75fde2411cda5222a3693ec25a75920ff0e6fc331798f481079f854092f5f706e3525f605d152d3894d8addd00e7c5f5f521324baaec3943af9134a89c1e2788
SSDEEP 12288:bw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bwyxknw4FYnshx8OfVe247
TLSH
T10B65237CBBDE94D2F54D11734B7163626609B5A6EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 ac86dd3c3bd109e309ad3abb0c0442eaa9fd8260fc584fe4c26f71d469f127ee
MD5 d843e908c46d1e610be9ca1e32c7beeb
SHA1 8745594ab2b762cd24e861d66c354cc5a235ca75
SHA512 eb1e2e71e8fcca468505b47f64f7f7332292dc130e0f0284175ab0bac5c29d285115d6cce4995ec0cb6082b82bbc8e514c5bf9cea78db16f579f133884bd2732
SSDEEP 12288:fV3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ryxknw4FYnshx8OfVe247
TLSH
T13265236C77EE50D1E85A51738A726222B365B8E5E731C35FCB64700EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 bd1a125294a7383abfb0a22f792b2d7ced938baceefb5bfceb96d20d563b0862
MD5 f7365d7da8d81a15d7433204102e4871
SHA1 50dcebb460f92f86e209a8d300aa196e9400fc96
SHA512 9693039bfff6627e5dbb9a535f236749623b0f6306b138176978bf3f9b1d7c3ab7f5f730aa1f496dec6c8702712a022bc8365706b4adb5f2aeec655b83e6d901
SSDEEP 12288:D/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:D/yxknw4FYnshx8OfVe247
TLSH
T1D665237CBBDE95D2F50D11734B7163626609B5A6EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d6261c9a2b9f6d3c2ccf094c2956c5007e65732757bd05860fb01390db21c782
MD5 8f1c63663cd8202f64e8fdccc287a440
SHA1 0c93390f2e6c00911fd9b2971c3ac1fc863c5a0f
SHA512 cc598c8ba1a1bf410cb2bbf2cd3102f355e2e369da36e52e0bd0ac13ae12255bb80fe6a9c904b6224ee358a32b238ba81b60ae5b9c0fb7320f7bbde1dddffb33
SSDEEP 12288:uG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uGyxknw4FYnshx8OfVe247
TLSH
T1CF65237CBBDE95E2F50D11734B7172626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d5ba8cfae7f748d16489a4505919d7ab32e7e130ce37740b8ee4b7161ae11671
MD5 709add484a53cec935a93f283a8a86e7
SHA1 58ec69cee5519158c6bb63b09b92be0bde9bf1d4
SHA512 fe3f0828d01c14a1503e45af57bd5612d850fae42653f9605f27f839c7ccd89b60d3e878a86f193f155318cabb6290f0f3d1021028b24df9fa23676ab9fb8bf9
SSDEEP 12288:Jq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Jqyxknw4FYnshx8OfVe247
TLSH
T15765237CBBDA95E2F50D01734B7173666609B5A5EAB1811BCB7DB00EF1F0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 12aa7ec286c99a08d47dc4be7a6683c61cd4f03dbfb56eaad7cf07efc00538e6
MD5 a1fb19ba1cad819f85fb585356dd871b
SHA1 05ec111d50ba27393b70f22a6d3c74561ba48854
SHA512 8ed23a3e0019694ac20965f507a424d70b7b1dfc9ce686beefdb157fe9f2cf582a0e6171832bc49d1a598a1fe2789d46ffdaf0bc2060f35c1ea035af1f21be27
SSDEEP 12288:9iZwbZzzFEoS2cPvyC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AZMdzFVSOCyxknw4FYnshx8OfVe247
TLSH
T1717501A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 cf3ef0038402216522034ba2bb09fd1f53947ffe26c3f8f060a7f46ca95c8604
MD5 10e1f11c1f021e2ec2ea881681e2f148
SHA1 b3ceca1e86715b3d8ac1715da89431a3947396a2
SHA512 3f020bfb896e28c79b65eda7dff191509e912306df40402173b98ec9777a5defa6f4d9c17c9af85f21ec90feb9faf940385c9eef34392b248e1251f1662e8286
SSDEEP 12288:BF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BFyxknw4FYnshx8OfVe247
TLSH
T1C365237CB7DA94E2F50D11734B7163666609B5A6FA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 1c79ea0f27cd8808e0bbcd7489e57e93c83ec318348867e0ea0fa22f41b85b63
MD5 312bf9b8045113d66736ee564470b89b
SHA1 4daf2275d6ab81a7a8c78ad44bcd9f33986ecf87
SHA512 25d5072db73ab619900f30342354f17078abd9c72f159bbcc06f344801cadf7cb8b53efc10d9961f35d1bbee7940ef77e85cdc8d7eb30a7b1be73759656a4bd1
SSDEEP 12288:Yh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Yhyxknw4FYnshx8OfVe247
TLSH
T1BF65237CBBDA95E2F50D10734B7163666609B6A6FA71811BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 a7824367f9ef2308d13a17c03ae1df6b90f8194fba7ba60481eac6081aa453d8
MD5 060ea5512923e272c76dd6c1aa3c1fab
SHA1 e0d0df9c8581d56e2cd2dfe92e657d8984b5a071
SHA512 92ff5586ac0dea3259fae02f431300286d75345d8848808cd7fcdc4b71f123ae358d4c61fb5ddff4040c1eff02d2eaea5c0f2da3e3326264ee35a38d6e4ebe41
SSDEEP 12288:7yPz5L8e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2zyeyxknw4FYnshx8OfVe247
TLSH
T1AA75125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 2b1baf5c5c92d26544fe0522ba2f42aa08b9291da5a432ae17afc17a174ca4d3
MD5 88729ff9c9081d779d7d6cbdc2673818
SHA1 73051f22b10a07dd2fce8ff3d2d50bcdde0bb5d0
SHA512 cc40271346fca8d45e6d06e4b32166713a032d462cb070ed5258c5930eb43f26c05e56ee4a48f2e52db427f6aa05929add89b0ff11819917791a185844f99d5c
SSDEEP 12288:xF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xFyxknw4FYnshx8OfVe247
TLSH
T1A86523BCB7DAA4E2F50D11734B7163666609B5E5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 83e1212daeb84090c3643613c2af2324c0c5964f2a9e3364f1ab2774af91c544
MD5 2dd57e8c1e6aa742b9cd73993acf092a
SHA1 f843424db55320a755de871514b878faa17d5097
SHA512 9510374c075fa4a7e54779f189e8cb554a6038927e78fa3dee018c86ed897a5cb2ddb0d0956919006ce3e3f0871d39eb071d900f5a7ce6aa0f6b539e80a75719
SSDEEP 12288:QF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QFyxknw4FYnshx8OfVe247
TLSH
T15B6523BCB7DAA4E2F50D11734B7163666609B5E5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 cab5d702cca44e1926c09d0b10723d7cd562e17c0233055c293cafbb9d73c146
MD5 6aa0f7d514c61479b00150c799be5468
SHA1 00091c1af8db4a785778a2a1f449dbd40d116228
SHA512 a27d8dd9a85f90ac65ee28e4fb4f27203c92da2c4c4e66aa8d83f4735ec55cf66375c8cfb47e0f678f2d6a2ff9079b1f441df60efb2363debe27b57d3638d4aa
SSDEEP 12288:GyPz5L8e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7zyeyxknw4FYnshx8OfVe247
TLSH
T1AB75125B73E530F5E12A4236C9621612F372B872473086AF87A4527E6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 145603e9f8eb4fc70ba887b614dcefaa106d85c8e846c035c0701042627edf3c
MD5 94f988c6a253d3c9768068a6891f904f
SHA1 331b629bd22cc9f3f29723578727cb395c861d05
SHA512 5730def336118a0b8073f477e11e5d5a16cd0c8999c41490f2ad6802d119cb12323978e6bf422901246a547dc9f60c88b8201eeefaef4e7ad151e92d050dc53f
SSDEEP 24576:4TGaLl3z0zDgyxknw4FYnshx8OfVe247:4TFLljOx4x8EVep
TLSH
T18A7502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b3f5e586c9f276cfa99d3ffdc235a6281290f99670306beaea177934c29e6b24
MD5 55b2778b41efcd0c9b624b16d7864a6f
SHA1 3bcce8cad697edfd64068a8e2459d703b3696220
SHA512 d5a0de17a52ade5b43abeaa44d58e5c0c28afa792436070a75fa2e5f54d06ffefb7a4d91a577fabcfdb18cd0608dedadd8abfecf49d83cb43f3639ee8478c344
SSDEEP 24576:A3Xd9CHKy7GZUyxknw4FYnshx8OfVe247:KXd9CHKyaJx4x8EVep
TLSH
T16895DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 cb3779aafee3a9dbaad0f8061695dfb62c00ca45aad55f23ed26b7285f24e53d
MD5 da57ae6bb005664c6f55345a45de9f12
SHA1 b11b50f04030062547db7289a0a2058540c9b7fd
SHA512 84bfdd7d45d9a50f498ea47af4cd015ae2444df5a90dd11052f872baad4fb3d165b7b0ea214fce19f1b997c829bd9b7bd012ffa5bc24e42a57d7a8e719878ac6
SSDEEP 12288:YQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YQyxknw4FYnshx8OfVe247
TLSH
T13965237CBBDE95D2F50D11734B7173626609B5A6EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 95f4656d6868738f137bd1cb379f3310f1669371abf208835cce42a3b41d084e
MD5 30e94917ef8b536af1fd587538504614
SHA1 3b098b89c0c7f0e5c6f72cf1cd515af93585250b
SHA512 c1ec72bab1ee9c2cb011454ec99b07fd0bd29ff697855d674018357654dffc5e48ce8aa7cdbb1b72dcb28d3f1ea0978406343a69341a7ac2666558bf3ed64b7c
SSDEEP 12288:V++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:V+yxknw4FYnshx8OfVe247
TLSH
T1FA65237CBBDA95E2F50D11734B7163627609B5A5EA71811BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 fa1360f3e598fb00ac9a0f6437c75521623c5c25f773e559597be93729fc83d1
MD5 048b6473ebd539a864d5f1c310e4a166
SHA1 877a99fb2118bea4d97506081120db5d1632b912
SHA512 d93fbcdd79ef15c3ec69aebe7c37e2db1963605055ccefd71b2b2d6d86be52aa704b1b876b2f6a742e41cd1aa300062fd127cf5a6ecdf25ee907ac009e525263
SSDEEP 12288:v+sf1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:11yxknw4FYnshx8OfVe247
TLSH
T1A975F028E29802E4D06E2276CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2c428914741be9c8ca51a80bd7c3bbfb305260594f74b969ce083a926a3faf63
MD5 62aa781c8edcc026e24407e27bd50803
SHA1 a26038c921fd19939346f32b428f0a8ae3a3c4ba
SHA512 69617ab6d6f5412a529ec27438ced11fbf5c2a8c72ff4cc4d882bdd567935d41b5bf4786dae6f125f7ba82b28c3c64fcdcf8b4608529040016cc7de5e3349d76
SSDEEP 12288:id+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:idyxknw4FYnshx8OfVe247
TLSH
T19F65237CA7DDA9D2F46D15730A76A231221AB1B4DF71C18BDB69B14EE0B0CD0A83D613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 39282929baaa8d0cdd126955586d5ff604c67231b6c83368f62b1f5d7e5b694d
MD5 5326eb1d0eb69d3bb370f5eff4cca860
SHA1 0e4e9a553c72e9918b652e1da7d134975f00992f
SHA512 4eb402794f778419271855567a1ba8870a8c754581afa26ea2040cb6c2191bc36e57faef1e17c60d80457b455653543567e6b570e0011fc72d2d25606bb8d290
SSDEEP 24576:08RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCPyxknw4FYnshx8OfVe247:9RZwQCyiHiQEaaPnMXx4x8EVep
TLSH
T1B585AF1D63DC46A5E0BAD2B8CDA74407E6B27816573193CF0291C27D2F27DE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 40c3335133f71a851f319f4be6438fe118a291330a473c7a7623647c0692c947
MD5 9b2d7f90810aeeb86cfa985050229b96
SHA1 e82bf1e331071c3c3453e36fc662103eefd54ae1
SHA512 a173b6e1264c4925a5acd9e1ba72bf443b22bf520ac831be20a65c75604cc49423d78a0740c6ecb10e866a0ca2bccf0886d2218d355787488791708860e83c8b
SSDEEP 12288:ibxA1U7KNA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ibxA1UGNAyxknw4FYnshx8OfVe247
TLSH
T19465123C66EC24E1F179913A89A18206D332B866673193DF52D4D23E5F32DE49C3AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c2b9fb6b22ed99cf23f7aab6b0bf037a32b15a2663a031fc846a2065f2703d6d
MD5 ba0ae2a2230d3131bec52f214ff4a2dd
SHA1 c351006498e7a4027993cf18b504a2a5fb395c5f
SHA512 9d07e7ab5896d2d10a36c671056546142009aef61790a8ed261e34b2c7ba55601c4b34361fc453b4bbc7d9f65895ad84d8d73d5045ff8b209d7bd4266f3923ca
SSDEEP 24576:rjsmP0yHaqrVqHra44KDzMsrnyyxknw4FYnshx8OfVe247:rjRP0yHfVqzlAsrntx4x8EVep
TLSH
T13E45AF2DF2B910F9D4AAD136454107B5BB71B42D1F209ACB4170C239AF06EE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 f5c1644c986242655b2e0ee9ed76b7b737e01a9386d17380049cd0fabfe808d8
MD5 9818abe012df71dffedaab8f463b6eb4
SHA1 6def2e67528d0d5deb45633013624e2b63d594a1
SHA512 d814714eeebd29466404b8e14520fe3f11714263a16995d4b0a106cb3074e15ba099ab93a33aaf6c4e4d95c9d874576095f12070c6944e6738f815a464addc20
SSDEEP 12288:Z3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Z3yxknw4FYnshx8OfVe247
TLSH
T1F765237CB7DEA4D2E95D15730A7162223205B6A4EB71829BCB7DB10EE1F0CE4903E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 36b974b5078740150a406309e1412450f0fa15f4a174684495ff42458fc45ed0
MD5 eee93315e7384ed1f26523e4847dbbaa
SHA1 406e71b135b3f89821627b149f196cdef6ed5af0
SHA512 4829c27a8d2397c5bf5d8eea14ff767c0095fec35008a17a7f9775fc5b0c9a9544f4223f83ac0f22f38e50a6b77fd54a7c1e720134cc880f5f01c15a57e3026a
SSDEEP 12288:hOb6A4LWO+vAYFTZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WCLBUTZyxknw4FYnshx8OfVe247
TLSH
T15F850158F7E400F5E86B813DC9729612E272B49D0774E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 cce3d194d39eb42fbc2f096e4e4337cfe77d3c9579d4b832cf07a83960ed3ebd
MD5 d8ce773d651c52a4d715ef37a072fec0
SHA1 8e1d85f7598cd089999a4047c32471393aa3f94a
SHA512 d3936b949a7a5a949632a0d20cffdd4ec358c42a834a6b649c8a0c8c5da4850593e415965ef0d4ce37b7f3fbd044a16b5bacb1aacaebd79b822f89a7ac77bafa
SSDEEP 12288:o70VmwIYNvUyBpI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FgYNHeyxknw4FYnshx8OfVe247
TLSH
T1CA75F22E62AD1CE5E57B517A8AD38209F2737466172192CF05B0C27E5E23DE8BC3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 af44e3f89c9976d56e3c49264112bec74f5f15c890e7cf5cea8b5d795b707b51
MD5 63712c707bd76cde1122364b04a0c163
SHA1 f59627684ecb1fac5894eabcdc5517f8e3706306
SHA512 913280ea1f05d89ac90516dc53d14c722ed556a30e858ee4166b54edeb8c56193d651a99f3b8ef3f211f638bb5e36efdb48f78fc92a5aba3616e6927560e93a0
SSDEEP 24576:TnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK8:TnXoJJYH84VVS6AmEcJas+cHBjSSKHPs
TLSH
T1B265BFADA2BC04E8D5BBD17DC5C24506F5B178621331C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 aa37fdbd30a98823b70361fb418beea7a0cb656e59858e50a4e1456b3c96b6be
MD5 91d66d573c1ef569726719ba15fe299b
SHA1 af1d490f91a0f3092f25ea884d69ac5371df3e1c
SHA512 9aa53baa13e3abd468108033ed18a42d10dd10b2afb2d0be760fdf3ea44dae07839b2b941916c0cbc336e80aa009449e50904fa307c9198a432af9898b66569e
SSDEEP 24576:Zv7Xbxd9Tuycf8M/TYlSuxwr2PCQyxknw4FYnshx8OfVe247:ZDLL9TuJ0M/TYW2Pix4x8EVep
TLSH
T173858D5EA3EC42D4E07BD6BD85B79146FAB2B855273081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 780f9cc9d1c67d165586be757c39527d53f66befae2549bf990ac82380d5e414
MD5 940597adfa4c3c6bb86fee0c685b9391
SHA1 f84a544ea9efa6a65386c0f7c7fe4f72b40c24e6
SHA512 7fcae98f334cbb973ca97e2b2e039e525a57ef7081328299aa9bbc6e97fbb354334dfa137af78af62573f0dcc8ae6ee5f62831d4c46d1482a4fe6206208cfd0b
SSDEEP 24576:qegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wZyxknw4FYnshx8OfVe247:qngOJOmPOHhcx4x8EVep
TLSH
T15E55CF3EA7BC15D5E03EC17E8A928916F6B1782603355ACF0160827E5F1BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 16f8b67e023c6905d7f68c7d06a242370bfd693e8563699b68c48e4da77e5531
MD5 5e87f59ab5ca50e32ff522f776c3281e
SHA1 9fb95a0a61114cb6644acac38991e042543200e8
SHA512 b1334cb57a83b87f0c4c3981ed846cca9ba348c71fb138746a6120037f503cc0a9d61caac3a077fb2fe5683239fe496634e4cd4b7ca8c651cb3766685a1d9244
SSDEEP 24576:aLJnJiTk3R3waE4JrOXyxknw4FYnshx8OfVe247F:aLJnJK8R304l9x4x8EVep
TLSH
T19D85D03CD2A810E8D4B7C2B5825A2756FF31347C2B2169CB59B4D4353F12EE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f5c77b174e6576047a2dceba2f7ed9a3ac725cc2895b0abfbf0d1bc372efca94
MD5 621a9c60d9dda6e56909e52912ec5d1a
SHA1 b672994a7209bea84569c722350f28368c3b49f5
SHA512 68cf41074c11665ea20bdc2159970da9bc45916f4797567b895663624517c54bae4620c4f510f09838d04a9d7da07316db604c3179f8f40c5b47661fbf74fcd6
SSDEEP 24576:HA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6phyxknw4FYnshx8OfVe247:g9GqCzDScAZmlvTcFg8Ph6ex4x8EVep
TLSH
T12F955D15F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 b2af16208f17c4b092e321b40688db76961aec38f29bbe96e94817303f3f55f7
MD5 b55ec438e692f91d962a40d0b425aded
SHA1 fb3e3ce1d434b191cf59d2bbe671920e02a057aa
SHA512 8228e5563142da5aade28f1bc88d27433b9589e99d8a0c35e10f8b8aea7376db929658aa84bda83d13f794d04578c58a6791072bf5155d736ff617b18ea1aa62
SSDEEP 24576:0lYJeXm5jUuExAyxknw4FYnshx8OfVe247:0lYJeXmRUuEpx4x8EVep
TLSH
T1FA65126C769D70E1E12E507A8AA24615E372F0B1672153EF82E4D17ECEB2CE06D3DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 8d46441579fd70f9691cfec24433d4d58d362cf21d789126488ae9d7fc919aab
MD5 adec88bab166c8f12d6e6be45d93c7f7
SHA1 4798e98f7778a180693239f958becf212eaab399
SHA512 7d79a02637fbd89ec808493f6c0acfe6aad5eb72ad540e2ba8c8ec3c0e0dff5b7bfa3b8562c53418d7677e28855945193210117def98e601c8817680ef4eba35
SSDEEP 12288:OTu6kyS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OKtySyxknw4FYnshx8OfVe247
TLSH
T11F75121873D965D0E97905369A734261AB35BC709F3183DF86E0F23FAE719D0A839B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 5fb2f231e929563b993722ea0fafbbf2f8bcf2a29df38ecdd844c1ed5c2ce159
MD5 0e3d69a58c94d54f6aaf2f8647f65cf9
SHA1 c00a8c52b16be2285152c3518913f35b51a9ca1d
SHA512 c0fc2f959d4fae59721d1e1d66f84bf0a6816fdb2da8b21210887fa1a32c173f6b562ef6372686c6204b9b545a7d7dd6cf6519ee7c4244f981f14e55bea79c87
SSDEEP 12288:pPZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tZyxknw4FYnshx8OfVe247
TLSH
T10A65237C67DAA4E1E8191573463262626215B1B4AB7191AFC7F8F03EE5F0CD0A03EA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 fbc246b2b23a578845a0a1cf4f85c5b059a09b8d9e4d667fb459dc09fe8bff61
MD5 3e07e371cf8e55780b1c8d8cb2b8ba49
SHA1 5a8569b9475fc46e68bda58d25af202b4d4c43ec
SHA512 7ce8f891490d9116efb9900ab982e5172aeaa1cdf8431faf0e227a4e3bb26a39566535e39edf1cc153e12d3527c7108d0d2398d233a66e86437b8f22a0c0ad95
SSDEEP 24576:wC+TyQIu93VAumZr7jmkyxknw4FYnshx8OfVe247:w/TfIq+Y/x4x8EVep
TLSH
T1E5558D2DA7E91DCAE276C675C9A34493E633B472137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 b408a1abbd663312f92f777d77359afc4bfb777d29eef45b3711cd3d929c139c
MD5 51c31967601cf12b297fb4840aeb244f
SHA1 5978e07042dd4ebb9df39f13e82a0aa8b332588b
SHA512 9bbc796cc4f71b1574170fea6758d71a8258f8679fed27285630d3ec089f5b5494cf9737c09b0eff2f4324907bd41f00f0bef79eee9e13c5b12ba100b6d871bd
SSDEEP 12288:ycyrWOstaa3kcsF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DLQikZFyxknw4FYnshx8OfVe247
TLSH
T1A575F11EB3AE10E1E0AB813D89554212F673B074572263DF42A0C77D5BB78E9BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 82272f7305eb6e9ecca031d0efc850ac344103d07504c393cea9a41ff06e6621
MD5 0778be4e0c2f781bd099c2e2b4c07586
SHA1 f20fc7e8370104a65c1c5c0658246ae9a0cb9087
SHA512 9c4e783ab1a4a34f1c56833ad9d5f0cef8b143490214987a068092a78447fc1498838a3f9df4585c5844ffae03c216aa6dd9cccc59f69b120948583457cfadef
SSDEEP 49152:xpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPNx4x8EVep:CpC7b4+80GTkWix8EVy
TLSH
T113A57C3DE2F810ADD8AA8376C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7da8ad010d72b6e4091f74c6c3a0a878486ad60c2797694ba2a05c414e4debaa
MD5 73bfe1bf90ec63f5c951c153cab34f67
SHA1 4da030a11be9cd8c5e57d00039468baf0b71e043
SHA512 ea13dcbd3560de6e87f8b7b575bda8ce835052d46f8f14af2cb8c1fa22e79b00a55a37cc936e02264e9de584bdc0600b01d265f56c238fc2804fa9d35e2c9b31
SSDEEP 24576:8SAwJPE1IDAo+4Kt+l44135UQUAyxknw4FYnshx8OfVe247:8qPCIo4Kol4/Qkx4x8EVep
TLSH
T15B55B029A7F956F4E17AC7B4D663C611FB727822133163CF8290913E0E169E89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-312-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/236-310-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/560-257-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/560-255-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/560-250-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/560-322-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/652-21-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/652-20-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/652-0-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/652-9-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/652-8-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/1040-246-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/1040-316-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/1992-29-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1992-22-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1992-17-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1992-231-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1992-28-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2160-327-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2160-426-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2328-277-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2328-425-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2328-343-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2556-383-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2556-341-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2556-335-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2556-415-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2556-399-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2556-428-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2556-344-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2668-421-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/2668-304-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/2668-296-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2668-302-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2716-232-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2716-41-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2716-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2716-35-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2960-264-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2960-326-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2960-270-0x0000000000720000-0x0000000000786000-memory.dmp

Download

memory/2960-265-0x0000000000720000-0x0000000000786000-memory.dmp

Download

memory/3016-331-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/3016-427-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/3220-282-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3220-417-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3268-77-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3268-234-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3268-69-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3268-75-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3404-440-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-451-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-453-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-454-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-455-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-456-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-457-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-458-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-459-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-463-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-464-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-465-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-467-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-469-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-468-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-466-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-461-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-462-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-460-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-452-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-450-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-449-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-448-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-447-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-442-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-431-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-432-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-433-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-434-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-436-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-435-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-437-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-438-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-439-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-441-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-444-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-446-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-445-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3404-443-0x0000022947310000-0x0000022947320000-memory.dmp

Download

memory/3536-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3536-233-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3536-46-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3536-52-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3600-285-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3600-420-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3600-290-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3600-292-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4336-57-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4336-58-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4336-64-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4336-80-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4336-78-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4760-423-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4760-317-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5236-244-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5236-241-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5248-15-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5248-230-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5272-323-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5272-424-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5504-422-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5504-307-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/6008-275-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/6008-330-0x0000000140000000-0x0000000140162000-memory.dmp

Download