09da5a1f71906ec23bd2cd36f9ef3154097fc95ac95fb3f41c23cf6b87880968

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Size 12.3MB
Sample260426-ftmmlset2z
SHA256 09da5a1f71906ec23bd2cd36f9ef3154097fc95ac95fb3f41c23cf6b87880968
MD5 a2b6fe672944f31aa6268fdef8e97cb6
SHA1 9689eec4e0e8a23072f1cc05ca3ee2100050e16a
SHA512 7051312be0303f061106fb5b70ef9236838ba7c216576049293eac40c8b0e6702544e450344d59b0f99dacde9595b35b101f160e6b4b1366fcbf38de2ed4daca
SSDEEP 196608:4hr1I2WcqSjj7UlG8drCeqBvKCzcLPcKZ:4hr1tqSP7UlZdrWlDzcLPn
TLSH
T176D65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4444	alg.exe
4092	DiagnosticsHub.StandardCollector.Service.exe
5256	fxssvc.exe
3204	elevation_service.exe
1192	elevation_service.exe
5260	maintenanceservice.exe
4764	OSE.EXE
1552	msdtc.exe
3184	PerceptionSimulationService.exe
1288	perfhost.exe
1504	locator.exe
4992	SensorDataService.exe
5384	snmptrap.exe
4260	spectrum.exe
4396	ssh-agent.exe
4500	TieringEngineService.exe
1384	AgentService.exe
5464	vds.exe
4420	vssvc.exe
3816	wbengine.exe
1484	WmiApSrv.exe
5260	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fc06e0acfd664f35.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bab1e72d3bd5dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4ae252e3bd5dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5d44b2e3bd5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012b3c82d3bd5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9e9202e3bd5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004744372d3bd5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c64d92d3bd5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a79c122e3bd5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4092	DiagnosticsHub.StandardCollector.Service.exe
4092	DiagnosticsHub.StandardCollector.Service.exe
4092	DiagnosticsHub.StandardCollector.Service.exe
4092	DiagnosticsHub.StandardCollector.Service.exe
4092	DiagnosticsHub.StandardCollector.Service.exe
4092	DiagnosticsHub.StandardCollector.Service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4108	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	5256	fxssvc.exe
Token: SeDebugPrivilege	4092	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3204	elevation_service.exe
Token: SeRestorePrivilege	4500	TieringEngineService.exe
Token: SeManageVolumePrivilege	4500	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1384	AgentService.exe
Token: SeBackupPrivilege	4420	vssvc.exe
Token: SeRestorePrivilege	4420	vssvc.exe
Token: SeAuditPrivilege	4420	vssvc.exe
Token: SeBackupPrivilege	3816	wbengine.exe
Token: SeRestorePrivilege	3816	wbengine.exe
Token: SeSecurityPrivilege	3816	wbengine.exe
Token: 33	5260	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5260	SearchIndexer.exe
Token: SeDebugPrivilege	3204	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4108	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4108	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 3628	4108	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe	84
PID 5260 wrote to memory of 2796	5260	SearchIndexer.exe	120
PID 5260 wrote to memory of 1508	5260	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe" --type=collab-renderer --proc=4108
  2⤵
  PID:3628

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5428

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1192

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3184

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1288

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1504

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4992

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5384

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4260

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3720

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1484

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2796
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 46d99cd9e82a1ea95d98aaeed51a4ef2dccded18b2332f713084f5791094b28c
MD5 b4c93918d244151b72b28f46427cf05b
SHA1 ff8707a71f4b51e685b4f235531bcb2de2a599cf
SHA512 9535269f5e098487a0c2977360dbab28046dd1e7e81654ff2c5a285295649de31e3290ab15840cf69694ed90ff876ac8c5d4162597dee644250803aa87d4cb6b
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxn+YPKEnSG:E3q6HjB3YPKES
TLSH
T164D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 51f1751b1d2586430eb206bf8b373de6ff6e52e45a201a244763e54269265db3
MD5 3efa9d191f57d3b89645b10467d41436
SHA1 60c1ad7d0b557575f2b21cc149e8dc39462c02a9
SHA512 f0e6513f90a4d26238eb7bea6aa385b8e89e8e876bf44d4026c969c93d01618128ae4a80e888a19aaa7193bed2982e366739bb21bb52385a4f406a8b3171043d
SSDEEP 12288:o1XLsswWkxy2lRq2czAo45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkY:OXYfDtczADYz7KEMdX6keYnAcerN
TLSH
T1DF85012867D508F5EC67823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 30ca734de1167d4a75497012dee7306fc55ddbb9d5ba05f41c0aa0ff22fbadd2
MD5 3b87b3ef1368b98d7aa218fb0c3db78a
SHA1 83e86a4a47d7efdf5ef7f5c2b5c8043e5021cb87
SHA512 dc9b1268b624a99a54809e8daa2c620d9870507633e4d6ac4787531ed72ed7f968a81c396ba06a69190bce9024fff8391e2d3ea734f20d27ccadf7b02a722802
SSDEEP 24576:K0Le5ji0hmx3rMWYz7KEMdX6keYnAcerq:KPji0AZZYPKEnSG
TLSH
T15DA59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f8f09f335b9b03d1d4412b383645e11ff5e1df841ab5e612dc3a34f572bae040
MD5 81ccfb5d4f5bebbebae4428e8b6d9a22
SHA1 b4f761359d8c0d27e557a6684e3f0b07a6ff436b
SHA512 6592fd564c4f8bdb907e4e9f5bd66165fd8d5cffe636c2fe7a4b4cabf325520231f56378c1e24a56da67bbf2822da513358815f7a2da8d2950895822a15df289
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWE6q8wyuYYz7KEMdX6keYnAcerL:d/ezSC6vUzPvxHjylYPKEnSG
TLSH
T15E756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 844851d5dd3f7e688370ad9808ef51dbb554c303b3a490dd79ea2c125e78d3c5
MD5 a81563f3855bf7429c51e0bd50db05b7
SHA1 c18fc8693dd9ecba09fb367d8da20b934230a137
SHA512 afc1769c8e16444dfed1cdb40261c0af7aa095d3fe8d422a3d6d9cf6b719519b4f3dd3eceb2d38f5a86e2bbff1893cb921e6a762f20c56df79ce2f8a429f9b9d
SSDEEP 24576:LVbqPb88hv/l+6HYz7KEMdX6keYnAcera:LVO88hXl+yYPKEnSG
TLSH
T154559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 862168cb4b6d345615d6f4ff2634c18cdcc096446afb5c67662e4d8b4e3544db
MD5 5e0051fbae122db8e6b83f4721e572d0
SHA1 ea56ff7e8e38ab19d4ec5f56721a961fc1e8c1b5
SHA512 56de74bad7e3cf4a54e813fa0c35c2ae35ca26453dd380948da5842ac987d4081c7ae2decb66ab95368567197504bd9f313da59c272cce0cafa31afd8d4fe027
SSDEEP 12288:KXV45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk7:KX6Yz7KEMdX6keYnAcery
TLSH
T1CE6523048B1A89C2F85F467BFFF5894085375DC62A9C97A1C94CFA4293BE232C50679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 5899317abe86e03ace1e068b0064a24c1cc968029333487e02e5f32600f2d6c8
MD5 fab86b490f9c1806de5b8bf4d03b55ba
SHA1 040610df9080c2b099a48232294e79b4f61ea5d9
SHA512 b8470365585918bc8cfa3ec49c13ca3f7df7a3062aa8a4fc718f9b6d6fe8cba06ac79e2382c6b8e6afb23fd11b30fc5ede5e655f1aa7f0a9515c525f6bd518a0
SSDEEP 12288:QeBNUbTVO86U845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkO:QJIU/Yz7KEMdX6keYnAcer7
TLSH
T1C085CF3BEE28FCD2C27A8DB95B918600D77278704B61A3CBD164C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1c5dd2e0579c2629f215b8c6e63b86d0ee668d98276e94bda3388271ae40a4cf
MD5 382f4f709522d6a31b7085ca9534f94d
SHA1 6174adf2ae670afbd95ee340528c70a66c2d56e2
SHA512 561eda1a8cb3b14ecaf0c9b137b0b986585841f5e87d0d91ee78503fb43250635991bd9a3a8ab59bb01d4378e275da9dcff6134128f67feeb179c6a6ed3c2913
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THW:zQvGAdlCEL8c/yRNw5CoYPKES
TLSH
T12F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 8f225dfd70b0afa495fa24a4371fcc244af60165ef467e027471f4b518c6e762
MD5 d62dd96a01e757e7078add1ecd1f7887
SHA1 36468f8b68d56df80a423e717f53624828ad82cb
SHA512 c3df1e7b5aea77d7434cb1c7b68a24f6179c353849af094b3d5a2b6314141db3602af5c1d52866bffb3c78290e182878c5b1861f75a70cd28a24fdf4d6f0d8ff
SSDEEP 12288:eAwSfxL/2Dc3BDLLmt0LDQewsAji45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkm:DkewsAjpYz7KEMdX6keYnAcerL
TLSH
T1D195E031FE75E432C67F0DB62B36C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c0db798acdbc82ce418571b1b0b5e1f60befc9fd232566f0e3724fb73a706eb7
MD5 320cdd765079bf0c51edca2cad33357a
SHA1 7a49da574a9d4cd26d6581b0b5eb12b6b9144cab
SHA512 43887be8bdcb332f28c3979001c463ea44c383763caf8caa414cbef0d271a4da3ac88185293e9a21a531412e6fd4acdb7808af5c56ff5b740117c50831756aac
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxcKZ:jUEtQevvqc2W1cpV2EI32xn
TLSH
T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2cbf9336042edf6246947cc7e134f03f0e0c594a73aafa82536cd132b8b39544
MD5 c58261e1e116a62f8bced04da643a3ea
SHA1 1b1e5c917d46916b871c01232e08b65ded66416e
SHA512 059b4a76dae6252747123e2a78d9dc03d509cc4a2823998db23289c6d52a3a3e5d17cb50ac9e0d244ee32bf7a089063ce0ea302190da8eda0991630a8bdef1d6
SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/zJYPKEnSG:coqtVjnmUYPKES
TLSH
T115D58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 25dc7377f26710e743a6298d612b37fe1e28306191a3893c1f2d6f89cdf02055
MD5 1b703fef7d16084a4234aac5810774c6
SHA1 951c078fbeb776f4b706892c118e75982c1f7494
SHA512 5d158915733e6db586404617c9656f1474f6b1e22e14f14b5b3e95d0e5b3d538a42a149934607814141595061ff859d248a20d0b0297f6d2b29c3c4b8da1d2ca
SSDEEP 24576:mAhGLJIFoiwtA5l7S530Yz7KEMdX6keYnAcerx:mAMyFoiq5kYPKEnSG
TLSH
T14435AE80EBF955D4F5B3AA78A9B68570EA76BCA65E31C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 98925e05bc2bd8bbc8e263a961e0d20a663261626ee20519e575d0268bbfe9e2
MD5 b0fce26ab49828ee3f93993359dfc128
SHA1 ca9b7af788853cf7f4946324a5fe519201b22175
SHA512 b90a83d2d88ed796f87c50604649822c0b62b35c6fff06518cc4ac49d083952c30e4876696d530a5a0553481621ac5c168d40af05491ec77f3981fb229a2e75a
SSDEEP 12288:wmw5HEjsChNzBFgl0WDm+Cn45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk+:twuSOWFYz7KEMdX6keYnAcerP
TLSH
T1E885F14977A90CF5E8A78239C697C132E7B2BC422A24D71F4760C6576F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f03dd5ff74c8773bb091862a8145cdb4c53e52799cff71370c27797eaebf8455
MD5 b8bee5e25536a40af92318fbb6b34896
SHA1 6d654483576b4a8cc14b29887077e301e8553e25
SHA512 47d657e71d0f2de5f14b534e0018ef55ee1e4d561c3d761581b06bc77ebcfe90ae8cf35a9d87e667ca86a27fee99d17e42ab6e22ec6e617f15c72601e605ee44
SSDEEP 12288:KjZ1Iyy45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk0:mZuOYz7KEMdX6keYnAcer5
TLSH
T12875124927A820F2F0A7423EEEF14600D7727893277983CF465892925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 05c103faf266fe1a3cccd675d812484c097427910610c7f30592f5b696add21c
MD5 9e63573c4c9af7c0d026f13428e96f97
SHA1 777923c3afcd478863c125f9236ae5b93b47d7e5
SHA512 6c1ab4fd42044064e91c0db3873b54715dc5a085b5e5ff755f4aa3a0738725237f694d96f76d20ca4a01f34974fd8ccdfe6634db302b6e4623fe1e4deb25730a
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:ZQRQyi36YOcPQLvw2gAf+PN37YPKES
TLSH
T1CA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c69d727ac19bef091616d67a557a85e0cc2f9fbd64d2d17690471f04d3182a51
MD5 99e95b94834b4adc2e4f7df047e0bc6f
SHA1 6a0cbaf7b6386f7e1a8a67e0b631168ae0952a62
SHA512 1ab5c98d300f99d72454cafe13b752a1f35b1ea8569ec2261e610d1ac2b99241ffc2001e214715cfdeb97b8ad06b0702e367468a0e71ce8725e4baa71aa2b00c
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:7QRQyi36YOcPQLvw2gAf+PN37YPKES
TLSH
T13D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 10d0dc3eb4097c7a62f74c734be801b14c0ee4cde78508efc05a58b08024642e
MD5 2f2d66e2f843074f30ae34ab41923d52
SHA1 aaa3a683bb9e80c295bc75d13689242add86f0ce
SHA512 5871773237deedf59aa9c3ce583b7bea045dda288604c075e02c84dc2c05b5581e3b9f3bbd29bd21e86d5641f9301044a796b039e41640e84b3e2c6f70d6f67e
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+Yz7KEMdX6keYnS:V68Qg55nhheWu7PNU3/ZYPKEnSG
TLSH
T1AFB55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3dded1767b2d2b2f2364a68b94e3176bafe64bdb4722c6d92ad8faaba494c805
MD5 3bbaa5a0cbaf5d8cc45e2bc84967d3f4
SHA1 ea19f7d922f3f7028ef8328f1ba25d33fa0dc308
SHA512 b965f462c3a3b63e98b5d157c3ffe829cc89535b368e137886f98d7150a900ce5957d95a1963d8e658a526207301aa51d569b0ba64444902011efb389b39a3c0
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99c:wy5112gYy5azzVvL69nLKnhZ6YPKES
TLSH
T109167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 35fb0dd0b7f2babe422b1bd1ad9a2d6de0976c5a0734fce946e1e28061f98197
MD5 54a0365da94ce3c858c16778100232fe
SHA1 962fdf39dc26232c9720c346a9c2ae23f028135d
SHA512 4e548859f989cf76904d7fdb9c1f76a51048178adfd3937265654c0fcd3befd4f06d38e6c06ca8cbd0127171fce1063684fc04b1036dc82bf320740665e0e67e
SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzYPKEnSG:cu6JmVxd2dzYPKES
TLSH
T150D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 753529de4d49c1407785de103dbdf42a86088b6843f42274cc418e8f8383ef71
MD5 fa29a85b0e8ee7669e556401ee1d4a94
SHA1 04b864a3034897aa8ccfe7220af0bfd745facec4
SHA512 01093bf2dd2b82fc316ab0c487f3761aba83ccacc1b3b82343255c22917ad70bed2196c573a48ca652d413b3255b4c7c4794d0ae130c78d214f6dbaf12fae695
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4xfYPKEnSG:fmifPbRUYPKES
TLSH
T18BB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 076a56f74769599a24b42d96e318ed59edd009a02aa10f9d9352b18302b24e47
MD5 cef64a2cf82303c8464829b1afbe61dd
SHA1 fa2ee3a601503b5ccf6373c3b8bc4a8cc0a5eaeb
SHA512 57052b271b4231cf6b078a6208d13da85fe1b88a5d6681e491cdf071db83650ffb9b3a7427489decb25d2f434927e3b4570b34d02c182a5a35085e459ba27a71
SSDEEP 49152:gSuZQIY0Be2KRRVtOnks6NMHqOYPKEnSG:65dKTi61OYPKES
TLSH
T188C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 478e50206dd4c8e9ad171987b4e9b6fbe3302379f7d33e151b59f27dc3ca4269
MD5 6d1bd7ecb9bef86e733eb24573497420
SHA1 86c0826fc24d623376550b5657eafa348afd3db8
SHA512 e9df24b6eb116ed99b5c66e4262f6fa70db94392043cb5d7cc220750ee4079f3768bd7795ecddc722ecf7c8753682191adc328b9b9dc5fc0bec804a9c2468315
SSDEEP 49152:3htSn8EApI0figngiDn0AP5wDYPKEnSG:mX2iyphQYPKES
TLSH
T11F95BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 9428361aba389c7f6e77cfbaa4f8fe9afc60eef494d141bcbe34c9fdebbbc72e
MD5 c01f468e5e49a63c1504602601eec850
SHA1 b43c859d6b31eff2b4cc68ab62d690de5f2f8b1a
SHA512 ab2d58668f80a8d2fc645153f0204795e20f67f999a3f0f207be9c788e49aa5917751e25574f4acf167ec73081b1a26cd5b4417249d0c4e1dbd72af9685c1c40
SSDEEP 12288:Nt45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkO:NyYz7KEMdX6keYnAcerf
TLSH
T1D86523048D5B8AD2F84A46BBFBF14540C53A6ECB3B8C83A5DE4DF50293BE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 a22b6b1c260af000a72635e51bf86e15aef098f727d8c12cf3533fd9150d30e9
MD5 d9a2b843637895345e5be6e294faaaa4
SHA1 e97276735a168e5e0b0cfb4e3eb96bf731bcf0b5
SHA512 f2370a09433c7c343d879d61f64f56a57c216a5ed00421bd8cc1d8666557d5222561d7dda82f2b2d4865d50a9139d396629b48cfa446195eb816180845612f10
SSDEEP 12288:8e45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk3:8tYz7KEMdX6keYnAcera
TLSH
T1286523048D5B8AD2F80A467BFBA14540C93A6ECB3B8C93A5DE4DF50293BE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 6eef1982e1756a99c40412f3c328d2a79cbbc4b49c6ec7a26b0a89b253952f21
MD5 9d558efaa6bfd949f040cde4db30ec12
SHA1 23166d8246e532d4a013363f1110b8066f6095af
SHA512 d440dd135024dae5f0438395e95ea6fee887db96d2910f5e122a4678f8fa00dcbe6ae138230ddbeba9f621b6e6565e1dfb9a2aa4f9c9216ba9639a55a3e0b853
SSDEEP 12288:D045Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk3:D3Yz7KEMdX6keYnAcera
TLSH
T1B46523048D1B8AC2F84A467BFBB14540C93A6ECB3B8C93A6DD4DF50293BE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4ccd08f1a8fb4244bffe9edf41a79e1cce939d772789c772ecf120f47f4b536a
MD5 1d19a46545dcb6ee14f5f977fe07ea65
SHA1 793df4a35fb3aec2adf6ebb4b53a8f414dde74b5
SHA512 1da56a0d1b23a55d40b4d321488cb32f515fa180da904e0dec11262e02ab4ef842894c20bb1dcb5a1beb37562e253eeb2e0b09e846eb27b25af38648294ee5ee
SSDEEP 12288:/Vr45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRko:aYz7KEMdX6keYnAcerF
TLSH
T1A17523044B5B45C2F85AC27BFEB18500D6767DC73B2893EFCE08A5424FBA3615924B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 1b45ad289a85e6c9e75978adcd9270b88d2149a898a2a12501b42a92b7b900cc
MD5 07df73e8d272d2794c81dc72b65833b8
SHA1 2e4aabfd7693deefca3688ab1802f4ffad85262d
SHA512 4dee631321943cca52b972329500fa9ff22fc1372b09480c14f3c45ccf24b1e021660302c101899274dca46397a6a4cad5eca33c6f424105056a6b3f1bd91aa0
SSDEEP 12288:1z45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk9:1cYz7KEMdX6keYnAcerQ
TLSH
T13C6523048D1B8AC2F84A467BFBA14540C93A6ECB3B8C93A6DD4DF50297FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 fd2f12477a4d15a2a999a0c24b8e3101d57af417a4e573ad2008b6557e14af63
MD5 7dfc9f8811c9afcba409bda0249d4f17
SHA1 181c11fe58f5ec6c0a5508cde055e4663d890ce1
SHA512 5be02fff51afc8d8a0bfffdec395fe9d9c4e43492ad197ceac2aed5a7f5227a050ad9357f573459afa7173d9ffb2e2cd02ecb6c81e6a49ef4c653ede7da48a44
SSDEEP 12288:d645Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkh:dBYz7KEMdX6keYnAcer0
TLSH
T19E6523048D5B8AD2F80A467BFBF14540C93A6ECB3B8C93A5DD4DF50293BE63245057AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 c4e71ec10450a9089bd8818b102f0d1a515fff6ae1f9a59ed1b0490b57b3a5fd
MD5 66abb3117c330222e0282c0c03aee147
SHA1 ba2c042a3b283da9223ac890247fa4c01dfeb236
SHA512 afbc43a6fd2adcf59add9aebe64e0654373874d0597bec8036509bbd5321a82cb6810727f954550a7726b3d0774f467a12e2dbe12505f543082335c4b5099cf3
SSDEEP 12288:jm45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk5:j1Yz7KEMdX6keYnAcer8
TLSH
T17A6523048D1B8AC2F84A427BFBA04540C53A6ECB3B9C93A5DD4DF54293FE6324505BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 5a06c5a2d58c76f10305cc285d2ffed75305a10856ac08f1b3bb84b8302211b1
MD5 a80a819c8d948f3cc16eec2894f19814
SHA1 5d74d0b8dce1d7281aa53f7bd14c550fb2965830
SHA512 d671bd2257740b46f5b6a339eaba3e1f121ea77f079052597c93d45b4454c90a23f2ec0057c2253e78b638e236db8fe3efb47ceae941ae8c17a23a4ed4b3374b
SSDEEP 12288:kiZwbHzzFEoS2cPvy+45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkR:HZMTzFVSONYz7KEMdX6keYnAcer0
TLSH
T1C0850194B3900CF4EC67823ECD658901D6B27C5A1B60C65F07A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 5394bc80fbef098ac57084a05e675f9ed06504bb38e30bece2c2ca261c4da7d0
MD5 8ccdb85e9a287a2fa36027da1e02e0df
SHA1 b481467dc8cb8ccd27611cfee8aff9018b5b061f
SHA512 a17ec526a7468965744e124fd5496ef0202951574638d86d39980217adea1267e7ef42ce264cc460cd8734bee784c9f56b9c912a4c4b501167cb93464b8fbf8c
SSDEEP 12288:FR45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk5:FeYz7KEMdX6keYnAcerY
TLSH
T1276523088D1B8AD2F84A467BFBE14540C93A6ECB3B8C93E5DD4DF50293BE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 8536cc805d8691ded2bde6a35c04b19b6c245c4e0b2d959bb82dfbfdd36eaf9e
MD5 20194ccb653a601c692761dc289dd63f
SHA1 ce1579489a95a135fbe4ada8364600bee29d3d66
SHA512 be3edc4b3a7489e32a22be6d65d90fe3e77258c0e008d31cefa3558e831a23309b8c04bda15b0b28650219d708cea8009728607a650bc099db84fb6eb158f414
SSDEEP 12288:Ul45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk5:UKYz7KEMdX6keYnAcerY
TLSH
T1B76523048D5B8AD2F80A427BFBE14540C93A6ECB3B8C93E5DD4DF54293BE63245057AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 21baad869e4dd155197692d67c8cd40341282c4bb973be0fc1550d72f0cadb67
MD5 a5e8a8f0c7cd696a14d410b8b60d0552
SHA1 fa8fd7445ef4440bfb57ae8b77bf89d9d32d49ee
SHA512 6ea4b3acaeb5c47a6472ede50528c3a8995be040ce6b168e1637633ac6154758f61af06ed5e7047822cd051411dd8c8842fe0751524b57311a28ecbb4bf64e93
SSDEEP 12288:4yPz5L8y45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkL:Zzy5Yz7KEMdX6keYnAcerS
TLSH
T1B575120777A630F5E0278239D9A10A01F77278761B248BAF579457732F3B3A15D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 2730adbcb1c465b6b22d4476fe5b55011e66cb7ab44a0a368c2dd8d322794e9c
MD5 1d07c5cfd209685c373482e1eee6e88c
SHA1 ab2529f0a5e4006f26e4b6875be05a4b39fdff83
SHA512 ac0a4ae35cdd911a253cabd8cd54428b46930f71f1ce44c3fb93a26799072000eb9b6a7a169558a5651cab6f736e2f3101430a820372f1b62e423889f7cef288
SSDEEP 12288:NR45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkL:NeYz7KEMdX6keYnAcerq
TLSH
T19A6523088D1B8AC2F84A467BFBE54540C93A6ECB3B8C93E5DD4DF50293BE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 7337e109517180bbebdf333cbe958aa3631664217668296778175b289fc77e58
MD5 e6ae9e43d0c63399092d552c3816e3c3
SHA1 fa509b30ba299443919b8d0cae22b9b8d30a997e
SHA512 2a58a801d28570dec934d80ad0c703ea5ae21e734fd078f9f035aac144953aba48a13d4a38908aa1e9efa4b822c3c6745a61f16c718174752af5ad4b03add33c
SSDEEP 12288:rR45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRki:reYz7KEMdX6keYnAcerX
TLSH
T19A6523088D1B8AD2F84A467BFBA14540C93A6ECB3B8C93E1DD4DF50297BE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 e6071b6212eb2b6a20a172c1466f2778174548723abdbcb9607b2aaab98cc43d
MD5 02d86355bdc53f3c02d1c1bef4acac0f
SHA1 1281c50b4c5d805ffd328af80a088e9e6735cdbc
SHA512 d2d1fe57847ea6ba7e61168dd2915027d5abea2a3fcfd3542f399d03510fc90c7131303dc05ea33e565edfb95a46466d5b103cd6daeb3bb45685c7fc1e6ba125
SSDEEP 12288:/yPz5L8y45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkO:yzy5Yz7KEMdX6keYnAcerj
TLSH
T16075120777A630F5E0278239D9A10A01F77278761B248BAF579457732F3B3A19D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 b22b24a5b4536fc4e278d109d8970501a22871c0bbad23ae0fffc6967fdfbb1c
MD5 254eb4876cd78a6ab3ead1634e2a9efe
SHA1 a97e6443547a0e8f88ce1ae99a144f579125aad3
SHA512 d1ee9f92e6a6f7a0734c4a46e250d56eedc7b2154b32e243b6bed60bbc454d7bf0af87f1f34f892f1e09c3ba600d73ee35cb114caa4e5da5072803e7039edc7c
SSDEEP 12288:aCd9ZWYoaLHF3z0z04PDvhk45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk2:rTIaLl3z0zDnYz7KEMdX6keYnAcerz
TLSH
T117850194B3501CF4EC67823ECD658906D6B27C5A0B70C65F07A836675F373A11C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 fe7cb832d7251de9f2e1df9752769c1f3c1bd94cf0bc6df9ceda6990463b1529
MD5 6037d411d3eef76a38310a72c24040db
SHA1 5ce6e4b8a7aeecf769d1a7cd068ff97706a266fd
SHA512 fc6fdb10e4d6edb1f3493a4d6b562a4063f02f890192a34d434576d5ae57a1df8cdf4176c402bc7f85d2c4bc7739b800c4357d08df812d654eee2e5d0e59c4b6
SSDEEP 12288:Ni4e7wRdTfgwCHKy7GLbbdIvP45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRko:N35d9CHKy7GZbYz7KEMdX6keYnAcerB
TLSH
T18995CF90F3E414E4F0B78A35D9764511DAB67C9A1B31DA8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 5c2e049fcff1670cba5b8f1f281dce4c7a4e9135ab28ceb3d9b4bc70ed99d1fa
MD5 d51914ee049cbc904fba780458f86066
SHA1 2752673352176e2decf64a4e421116e70716da75
SHA512 b1c3875e19f0fdc53605fae1dd60ae843f65275ead8be78487d9d1d69eddae0dfd27fd6683a5fd5de5ac454e0e7f1ea2d62e191e132a3a63228a1dbdf2594e18
SSDEEP 12288:2U45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk+:2XYz7KEMdX6keYnAcerL
TLSH
T14D6523048D1B8AC2F84A467BFBA54540C93A6ECB3B8C93A6DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 aacca9d25f9f7356992a6bf6c8f39d35b1e876d463fc3d908cb9a51db674da24
MD5 3b26d799b866afa4c74527f427c41876
SHA1 e48de3f808440bad413a0893b47d0adaaaa6760e
SHA512 70c2cc9dcc6a5077f3c643139075aad56786fabaccd148e41426a0ba77eef7dc51b005017cd716201c5819934408c4eb3e0af1bcbc627cd65ac585237f6e2a57
SSDEEP 12288:5S45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkG:5ZYz7KEMdX6keYnAcerD
TLSH
T11D6523048D1B8AD2F84A42BBFBF54540C53A6ECB3B9C93A1DE4DF50293FE622450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 51177d48db596c1051b6e1febbcb8b94d65942fa3de6760dca381bdba1acb79b
MD5 f6d1bc017b8031dba9c532e6064cc2be
SHA1 03b603e402a3aa893534eeb1504691a555c064b5
SHA512 c9a6df19ff5d8ef954c5ed885d1a9b79a8f0aaa20c29fe0236b88b98ca5debe77046a5624a113432d5f6228e2a51f090a98dde33b7bab317ee0ae4f7192458da
SSDEEP 12288:dP45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkg:dgYz7KEMdX6keYnAcerF
TLSH
T1E76523048D1B8AD2F84A467BFBA14540C93A6ECB3B8C93A2DD4DF50297FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 656ae04727a229921d5476e60c3b16599e9acef2bb8aa01de3c204e658d9fe7b
MD5 7482ce5b312c34023abf33896eb15d5b
SHA1 2dc2da4cbb808347889b9c9561f082040ac68d25
SHA512 5e41c8313e4e268a210e2bfea25f4f616b07cb2a95f0781f5a20e79ebc831bc26516b3b44a69822a399f3c9a459f5c955dea64e9f155807ca72da4cf9d0a7586
SSDEEP 12288:tzsfB45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkk:kOYz7KEMdX6keYnAcerp
TLSH
T187750109C29802E4D06E527ADB964A40F3337C6657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 a9aa50aabccefe07042ee1026b4af3f919a1c06c5b14fd6be8f218c7846decc3
MD5 81ecfc450cd1f390fd401abd4a7261df
SHA1 7aee0e43758e16c3e8c6be9205269049bbfc01ab
SHA512 7695575883f8f0a140cc0ec3a58ac7030b6b0251e6b96651bb609a7037abe0a87a838ad75ede5be0376d78fec5dc807e39fe907eafb7d5221ec6322c38e2ed83
SSDEEP 12288:qv845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRka:qv/Yz7KEMdX6keYnAcern
TLSH
T1747523048B5E89C3F46A4677BAB58410953F7EDA2F48C2D7E80CB24293BD6628C2571F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bd32e5e4748c91101b16bfe4e288d97e26345489533079129df416b186bad9fc
MD5 099fd96c810bac20a4d2ddba370aeeb6
SHA1 5ebaed8aecc1d340a9099ea9f207f45c473a83c3
SHA512 09fdbbd7df25be8e351408d340e2bc2b7d18f2ee2a177a219d583d659a0e77515c6fead21d7b29224e24cda43e2344121a19f9844b8fa65e91d63c32fe486208
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQh/YPKEnSG:Ka0hNYG4JwUYPKES
TLSH
T1D985AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 8ddc4869c3d6a446e368af56a5f5cbc01ba14ac17e51a11fa4434a5485b6b823
MD5 8f3f54af730d157081a288e2e9259d33
SHA1 8c0e08c4c645b0116e1dfd5d983f5ab789494195
SHA512 13468efa4808c9b68729942c071f47c5beb2072194cc798be6ec44e750229c7da8be3631965823a91205b3de7718480140f0c5c688372fb2df866c5d96be2cf3
SSDEEP 12288:YhbHjfXw45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkR:YhbHjPrYz7KEMdX6keYnAcerw
TLSH
T19875123D16AD10D1F476927EAAA18506C332BC562B1593EF66C5C27A4F3BEE40C35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 10e7a325896f44d197edb3e09a1fe7e732d9642a4c72826bc59c4453175d9b75
MD5 6a0cd7e798c0d44b90870ee25ddaba15
SHA1 34982c95653f594baa437fb9da49ccc0e8adf40b
SHA512 e5791d52de3b5c4da37804688acd4b1104d5d6b1466fbdcba93df906144df7a84e5fffc8d12e539d5fc5eff4ef9381998f24db13abbcc77df42c6218975d6b99
SSDEEP 24576:O3YgnJcRTk4yti+R5dBR/TYz7KEMdX6keYnAcerf:OIgnaTk46pBR/TYPKEnSG
TLSH
T13845BF2DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 f3305db12b0cd0d19bf40206c55f4ecade3f1c2ceb2410f9e29036bfad8e6fd6
MD5 d498aa29e18bbe1e94103ffef29f42a5
SHA1 246fda414a18e6cedff012746d91aa0c1c100bd8
SHA512 4f6d0c8a561ebfe9fcfab52e19b2a4ef7cea861ad98acbf821a097629537fe784d185646d6270a2ff46659dd04e6e6be39379181082ac108819d5c4c356d6a48
SSDEEP 12288:rL845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:rL/Yz7KEMdX6keYnAcer/
TLSH
T12B6523088A0B8EC2F85A467BFBA5851085366EC63B5C43E3DC4CF54293BE6F2453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a6dfbd4b9f4051062f11d32693ba282c9b3e6e6c4b497a967e8786820f612237
MD5 4b98e22c24f33a397cde88b3c9bd0ec9
SHA1 6feb19ffef610e302ece0d361f31f091c036e7ec
SHA512 64519d3b13dc503d29d93ea810a46a61bea6e884071a995c7478995b0ab27e28893791f7481313a4d45b4f99c8b08307077823271b3bc9818208f59bf851f70a
SSDEEP 12288:JObMA4LWOsvAYFT4845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkn:+ML3UT4/Yz7KEMdX6keYnAcer+
TLSH
T191950114E79500F5E86B813DC9B28912D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 84447b36453d23db28b0960ba57e7b50e54c1150d6eba8190ab2ca3b8232d4a4
MD5 bc8d50dcfcbe5981c8c5d4b6cfe8644b
SHA1 c6eeb672756ba583753d60e52629175d3063c23b
SHA512 050d51a5445cf1e58b89f346d0c97d92714dc1fc38d9df9a57d8b9bbc0552a41bfb4dc0d3ebc50a1ac6f3f9e2ee53aad349817e6503066c937b505dcc7ce468b
SSDEEP 12288:npFtOO0845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkT:AO0/Yz7KEMdX6keYnAcery
TLSH
T1D875121937ED10E1E47A913EDA928209D372B8A61B1153EF46C0C16A4FB7FF85C3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4f14e93bbe5854cb574d00d2e7465cf29dcf8bebf5f726358c13ae111f9ea88c
MD5 258767817429489fe358c7fe0ff0aa73
SHA1 e8e8d0bf5b6798f642348a19bea92ea2ad3b6e73
SHA512 590f9a34b5a201becbd94b06cd63c4067315bb218d1315c0d6afc5d324614208627ef2dd338e4468acd56183d0926fb19ccfd450d80237f333f4212a8329ee53
SSDEEP 24576:R7NM9YqZqmWMUkPjZM48Mv6bEhsf/Yz7KEMdX6keYnAcer1:R7cBWMpPjN8DbEhW/YPKEnSG
TLSH
T146659E2E6BAC81E5D477D13DC9E28205F6B2B4611B318ACB5152833E6F37AF44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e9733ae8aa122f7f4cfe711a80dcc73890a20e5a43940ba420f9cf4b5384af93
MD5 ea575a0098d367dd55dbc3347d10788b
SHA1 0e4d2b7c4d9b6befb56432983b710ab2636e6b28
SHA512 02749fb7330c57b1f1a657f065d776158f43ed2a05bcd8604fdc2f6178c0dca9a4d5a970f06d6891970ec27a2b4635565c1cad47c234dad24c20c2c6a31575c8
SSDEEP 24576:4W6BApg2YuyuNDYTabvcdvNYf8km11/Yz7KEMdX6keYnAcerg:4F2YuHNETovAvNYf8km//YPKEnSG
TLSH
T1C0858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 04364689d230f1db6da750a1f125edfc9aa3de1f03880370e84e5273c6cf0cc8
MD5 554656ce0e19aef9f75d9555deae79ec
SHA1 82cc03b195e0490b0da2b9dd8e9d7fb3f928993a
SHA512 427dc16c5709711660ea40741ac900cd4112f2e06cfcdf8f87726e055c0893e003ecee2b1b5557ad5782378ed58843ba4ffb067416f103bcd1ed0fc5e2be1f02
SSDEEP 24576:FAFs06+Omlf3NXEbTog/Yz7KEMdX6keYnAcerh:KFs060lVXuB/YPKEnSG
TLSH
T15865BF2F66AC00D5D07ED17E8A97C91AF6B1746307255ACB0160C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 6a681a47c08622938ee2526307a91d5e15513f5863620eb7634037d40ec2212d
MD5 66e3a9d5aedb3cd7b186b14245089b5e
SHA1 6c453fa84053408e61a90a4d4486ec5f38a80edc
SHA512 00e053f3997e08ebfd6452ecb825d1d66a3018453d4ac4d12ba7628287f8ee16482fdb5359bbba09c2a9190e6c8798979c8b84450843dd8134712fb595fc2b9e
SSDEEP 12288:5CJnJ5D3Vkrmzx/845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkQ:QJnJ5D3WOB/Yz7KEMdX6keYnAcerB
TLSH
T13A85D02DD2A810E4E4B7C274829A1745FF72386D2F226AC728B4D5353F12FE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8d4ea4910b39ae055cfe0d38b5c6facf8f90cbe22c5b60690d8594856a5ba59a
MD5 d79e217ede293e351eae11a850091956
SHA1 a1e2f15b79dc7349c01e0d4c0bd8200fa225eca6
SHA512 65dd7df3345013949b92691510220cc3633d71f7bc1d3d1d4a442844450589ebcb0eee707f764d1c1d7776dc76493a7b639677931b7d137c80dd830d8896ad3b
SSDEEP 24576:4EPghm6/7IIXdwcXrif7qQncjlP65i3Vuu/Yz7KEMdX6keYnAcerl:3g06DIKdwc+eQnSt65aVz/YPKEnSG
TLSH
T1C5956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 48680ecc70f54a8e199198412b490de04da47ef431503b0f2064a47e886eb2d3
MD5 c361f62a50e9ff3d05e7354ba4670f70
SHA1 caecadd1c93e94fdb9421359f36457840b49a693
SHA512 87d9fdb13d3890fd5d996052ed16f29612a5660f0e603fecc28fb99f7ce0cf96e8c54d31f7bae06ce286ab021d0bc6ddb98b61edad68cca2abcb2b4e560c518f
SSDEEP 12288:jEP3RGx45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRko:oG+Yz7KEMdX6keYnAcerR
TLSH
T14575121D2B9D60E1E02A913EE6A18500C372F0A12B5663EF56D5C23E8F7BAF51D3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 ca65198cb3991c5fefde095e770c2781f7f08d802544693c911abb967c47965b
MD5 de142ee3050b0d4304ea2b32309bfafc
SHA1 ec6e19954079e29dea472cbf342958e0ef35c078
SHA512 c565d4c356f43912fb7127ab8776c71af07e0f9785b7504241f70ad4a1ceb7ab20b37750db756138989488838e23f57ee14ebf9737a7fa1db81bda1a77b24423
SSDEEP 12288:2jkyG845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkf:2IyG/Yz7KEMdX6keYnAceri
TLSH
T15C751304539854C1F8BA4639EAB28190CA35BC612F1493EF9484F63F6F7BBE15C34B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 03fa11d1ab560781e41e592967b92a150c7e75e474c5fe2a7eea6fe10fbdb570
MD5 79309eb84ba1e8c8ee23fe46f73ab42d
SHA1 1e508a7d0c206aeee8ee21cf92712543f0c4bea3
SHA512 70266687f9252f9453db01be3a8d5adf91e025bd50618fa51186fb8e0a5a525a544388cf9f0c2c1aeda58e839fbb53e39192d4a4054fbcc56f7d2715a08caa09
SSDEEP 12288:NQE845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkB:2E/Yz7KEMdX6keYnAcerU
TLSH
T16465230C461B59D2F81A427BFBB14940853639D63B4852FB98CCF562C7BE6A24435F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d09cf394b76a1ca7f9a81c3ae368608105a4ee9b707c002254ee36c7254728c5
MD5 0267c9017c5b376495582fc07f8d3551
SHA1 6e548e43893d9e66365304f897602a14d131a0c0
SHA512 9309fcfdca95fa4b7859ca8b7b7126397fe53dedbca3d49ffbd7a132d302cfee365da5173aed871fdccb91f6a218f722dd4d08465bca4563a3f869e99da4c2cc
SSDEEP 24576:UQ9MxZKdcz9dw3H/Yz7KEMdX6keYnAcer0:UVKZH/YPKEnSG
TLSH
T18B558C2DABE9058AE177D27595A240C3A633B4311B35D6CF2448D03D4E7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 4ef0e43731e5ab4ac8833bd4fc2af80bf7a94b826207b2b10057bf6cddad7b8f
MD5 bdd1add7ae37951a86b9c9bedacecb19
SHA1 57789efc6ef327ee0c577955a17fc6cc46ae277e
SHA512 740f831f2125211208e3441892767159f7cc4bc7953768ed5ab5cae937928f746591dc54481f0b00f6a342eeb054e6645df2f3ff4f74f6344f088ad425c62677
SSDEEP 12288:pyoKo2oRple9py845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkW:pyocOApy/Yz7KEMdX6keYnAcerf
TLSH
T10D85E01FBB6E40E2E066813C89858745E773B0702B6253DB5581C33E8F67AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a47d3bbf029883406ae5300ea378a0a87d9265aa31ab87a0c7e4257aba21360e
MD5 7be89b9763538a423ee253cc1813059a
SHA1 34047b3505a6201a557995d06e1177d46b33d2e0
SHA512 fdfc518b2a412bfca79a46a9cb77e8d433673a567ee072d9845cb74adf302a0cf3b746655b084490e9f9885e41d851a385aabdd2acabe565d1049310a4cd3fb1
SSDEEP 49152:oWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKy/YPKEnSG:K0zuNIWYPKES
TLSH
T124A57C3DA2BC00A9D8AAC375C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f347e0ea6c5856c663223ab2fba4fa7c3addb4095ff81a0ebbbe56678acb8397
MD5 ffd87ddb87576788100504eb514be594
SHA1 0ad89d6f6b66f45348f4fd5ef6c8f55bc496e66b
SHA512 ae9720b23172002413ea62df392debcb3488834a7de46a8b45d5c5e4be3f3adac6ee5712b49d3cf730f22e3038ceae322f7518955bf5fd9cb0d7f02f823e3835
SSDEEP 24576:11QT7EcpfxR+N5AWAz3ooiYtjMqb+Yz7KEMdX6keYnAcerp:wTDxR+N5YzTfjMRYPKEnSG
TLSH
T1ED55B02EA7F905E5D1BE85799B23C502FA727861033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1192-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1192-249-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1192-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1192-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1288-278-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/1288-335-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/1288-283-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/1288-277-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/1384-325-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1384-323-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1484-340-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/1484-481-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/1504-339-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1504-287-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1508-447-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-439-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-455-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-427-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-457-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-456-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-454-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-452-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-450-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-453-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-451-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-449-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-448-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-458-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-428-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-445-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-429-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-444-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-430-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-426-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-431-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-432-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-433-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-443-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-442-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-434-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-435-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-436-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-441-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-437-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-438-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-446-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1508-440-0x00000239A4870000-0x00000239A4880000-memory.dmp

Download

memory/1552-327-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1552-259-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3184-263-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/3184-267-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3184-273-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3184-331-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/3204-55-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3204-248-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3204-57-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3204-49-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3628-37-0x0000000000710000-0x00000000007BD000-memory.dmp

Download

memory/3628-35-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3628-22-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/3628-10-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3628-16-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/3628-39-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/3816-478-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3816-336-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4092-25-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4092-31-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4092-247-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4092-33-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4108-40-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4108-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4108-21-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4108-6-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4108-44-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4108-43-0x0000000000750000-0x00000000007FD000-memory.dmp

Download

memory/4260-304-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4260-297-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4260-421-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4260-298-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4396-424-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4396-309-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4396-316-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4420-332-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4420-477-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4444-24-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4444-246-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4500-425-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/4500-320-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/4764-91-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/4764-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4764-83-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4764-250-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/4992-290-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4992-474-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4992-344-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5256-48-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5256-99-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5256-97-0x0000000001170000-0x000000000121D000-memory.dmp

Download

memory/5260-96-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5260-77-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5260-79-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5260-355-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5260-416-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5260-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5260-345-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5260-371-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5260-482-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5260-92-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5260-422-0x000000000C980000-0x000000000C988000-memory.dmp

Download

memory/5384-418-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/5384-295-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/5464-328-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5464-475-0x0000000140000000-0x0000000140147000-memory.dmp

Download