09da5a1f71906ec23bd2cd36f9ef3154097fc95ac95fb3f41c23cf6b87880968

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Size 12.3MB
Sample260426-ftmmlset2z
SHA256 09da5a1f71906ec23bd2cd36f9ef3154097fc95ac95fb3f41c23cf6b87880968
MD5 a2b6fe672944f31aa6268fdef8e97cb6
SHA1 9689eec4e0e8a23072f1cc05ca3ee2100050e16a
SHA512 7051312be0303f061106fb5b70ef9236838ba7c216576049293eac40c8b0e6702544e450344d59b0f99dacde9595b35b101f160e6b4b1366fcbf38de2ed4daca
SSDEEP 196608:4hr1I2WcqSjj7UlG8drCeqBvKCzcLPcKZ:4hr1tqSP7UlZdrWlDzcLPn
TLSH
T176D65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
1964	alg.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
3984	fxssvc.exe
2080	elevation_service.exe
4968	maintenanceservice.exe
3040	OSE.EXE
3620	msdtc.exe
2796	PerceptionSimulationService.exe
4756	perfhost.exe
3332	locator.exe
3812	SensorDataService.exe
3180	snmptrap.exe
4928	spectrum.exe
3224	ssh-agent.exe
3652	TieringEngineService.exe
3704	AgentService.exe
4564	vds.exe
924	vssvc.exe
3152	wbengine.exe
4856	WmiApSrv.exe
2004	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c2e7ade89fac755.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9621e303bd5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a08bdf303bd5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e30d51323bd5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000497315323bd5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b23693303bd5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000477731303bd5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
4124	DiagnosticsHub.StandardCollector.Service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3768	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	3984	fxssvc.exe
Token: SeDebugPrivilege	4124	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2080	elevation_service.exe
Token: SeRestorePrivilege	3652	TieringEngineService.exe
Token: SeManageVolumePrivilege	3652	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3704	AgentService.exe
Token: SeBackupPrivilege	924	vssvc.exe
Token: SeRestorePrivilege	924	vssvc.exe
Token: SeAuditPrivilege	924	vssvc.exe
Token: SeBackupPrivilege	3152	wbengine.exe
Token: SeRestorePrivilege	3152	wbengine.exe
Token: SeSecurityPrivilege	3152	wbengine.exe
Token: 33	2004	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2004	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2004	SearchIndexer.exe
Token: SeDebugPrivilege	2080	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3768	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3768	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 3536	3768	2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe	80
PID 2004 wrote to memory of 3540	2004	SearchIndexer.exe	105
PID 2004 wrote to memory of 3584	2004	SearchIndexer.exe	106
PID 2004 wrote to memory of 616	2004	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Local\Temp\2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-26_a2b6fe672944f31aa6268fdef8e97cb6_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe" --type=collab-renderer --proc=3768
  2⤵
  PID:3536

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1964

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2544

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3040

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3620

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4756

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3332

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3812

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3180

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4928

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3724

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2880 2876 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3584
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2812 2856 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 04e1d21fb037da0461d6abb4c5012c89fe94a7ca38a76e4317eea266c55f574b
MD5 e25ba1f09e038bc416636f7ddc01f18b
SHA1 b7c0dcc68a6b74853625e9e6247f9806c1f7fd7f
SHA512 15e0c00b1f28692ae7f318f7c531c8387f5186ed61deb721cc10d755dc8753abe32dea36a341da98053bae86dfc75428f17c835edeea330bf250dbae2a9c7840
SSDEEP 49152:ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRYPKEnSG:M3q6HjBgYPKES
TLSH
T172D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3371194499a0937a924a697962a069ac77471577dc4b16b37a7e0b2eb6ea78f8
MD5 b114a7a120cab9601c67b82333fa6a2a
SHA1 85e50f2709c659cc050089e8edd0ea2a5924c94a
SHA512 e65e3d7079967e755893e0f6d7266fa77d6e7c8c3ddc305c28dcf6762894c8345695d7a3e089be81386e6ca6a9c6981ea24f1228b6322eaf06e56e07e22831d0
SSDEEP 12288:J1XLsswWkxy2lRq2czAL45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkb:HXYfDtczA0Yz7KEMdX6keYnAcerW
TLSH
T1ED85012867E508F5EC67823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 8efa7be392d6a08be02994f69a270f18fd24f344825d0039b3ae74c0454cc6a8
MD5 c61cd59d7a488f67c0417ed504960fef
SHA1 21796b6220a03bca8c6b55a3baf6791d662aba0d
SHA512 4c491c8f2953c2f67af78736f456ede10ac6577f68f2b41b1e4bdc921638b1fc394a24734960b0bfeda023f23c3e8f0436d36eed42ed6aa6a1039dac6d9e6789
SSDEEP 24576:O0Le5ji0hmx3rMJYz7KEMdX6keYnAcerr:OPji0AZiYPKEnSG
TLSH
T1B3A59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a47bf7de3631a4642b32d29b3eedb8b393173f39ebaa8223107571b3668de6d2
MD5 58b9077b3f48868b75698e98b4215b64
SHA1 6027eb9654e597679ef16e1c595c093f13626d54
SHA512 bb46745c0be9857f366c9ce485205546cb6b73c2ab85e3e4cdb2291b0875dc93d52ccef25e6809c30e36fd4dc365e5917c273b7650b9ad3e994c60e24128497e
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWE6q8wyu7Yz7KEMdX6keYnAcer+:w/ezSC6vUzPvxHjyGYPKEnSG
TLSH
T1A4756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 15a96ef54917892ceb914b2f6513c0a0df5b116554002c8dad38f11e29da0b5b
MD5 e403193cd30509d01380d6a015b493cb
SHA1 53518e839afdbcec6f1f6b78209898b67756fe95
SHA512 210ca0ad8df7b26ceedb103311817fd606bd25ff177a066aadd4ff5bcf25753e5dfa2a0761c210af088f685e84e161e84e3f67a39103d9068ad3f7f30ef15faa
SSDEEP 24576:7VbqPb88hv/l+6QYz7KEMdX6keYnAcerm:7VO88hXl+dYPKEnSG
TLSH
T1EC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 44268f98c6836f72024fe50ee2ee71ac15e6879323f07ff1f5cd4b37f19332d6
MD5 4f5a19a749f70625a58b45e6d3bd8e66
SHA1 a34f663b81f011d409198d4fe0db42554608d493
SHA512 4e4e4bd66ec3b7fc5f97b2a244b8be298b7af4b768b9b191afbe75973c021342679c8d0a5328107635b5b3bd3daba896a763e91c8839ef5668d9b6c530d81ad8
SSDEEP 12288:HX245Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRksM:HXFYz7KEMdX6keYnAcer+
TLSH
T1EA6523048B1A89D2F85F067BFFF5894089375DC62A8C97A1C94CFA4293BE232C51675F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 61abd06287660806ec2919c041c1c96cb3c28d9fa8270e72f704f8fbeb79fe99
MD5 51df716e53dba44a2b22c9f1568accc9
SHA1 c1e549f8814df1e340bb9b8275ce95c52df0145a
SHA512 e3575dec3dd39c621e129a5b0d50848d91b8ce828e4eabc2ff822cc7eb855a1e91f0b73487f728191bbd608331a60907aec50333d30962bbc4540298ea4e2598
SSDEEP 12288:JeBNUbTVO86U345Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk8:JJIUIYz7KEMdX6keYnAcert
TLSH
T14385CF3BEE28FCD2C27A8DB96B918600D77278704B51A3CBD164C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 af421754c50949e517194996fb7145b6d03724ce79e51ac414ce84af14b5e0ff
MD5 67ade347f27acffe5779e7224d999d66
SHA1 2e675c595d96ad5f20ccff7883ddb2d38be781ce
SHA512 cdb46499c5c6a83281906297be1e082b3201debf9614fba0834008f25fd7b71979e7f4574e90694463ea454ce613d5d0ddb28dc0ea705cafef61b76232df14c1
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THz:iQvGAdlCEL8c/yRNw5CrYPKES
TLSH
T17F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 03af49676d7c979810fce80d97043caa6ca12850f7a239f4b50c88cc8c70dc4d
MD5 98613044336ff6adbad34b5c1c4b366c
SHA1 38c692574d132b2930d68a6a867b7cd8ac0a0c1d
SHA512 5bfc109d70b6059090cd0c9486be2d2d740e00a24708e04f8779b39314c1a2aa257f71ecf042607086b78099ae89dad51ccaa504657c74d862365c1746246a47
SSDEEP 12288:/AwSfxL/2Dc3BDLLmt0LDQewsAjN45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:IkewsAjSYz7KEMdX6keYnAcerf
TLSH
T16595E031FE75E432C6BF0DB62B35C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 964bbb0c69eb3da8a6e557c8665419f98a6a8f03468b533e042c674a90f568fd
MD5 aa9a665270b92dbc0f4316751e52d4b3
SHA1 25607fba97b1d5c1e37f6ba669861cbc66039782
SHA512 b4ea09585243fa4d83d2f60ae2294fe57c75b7f192eb030f4626a57eec340e32bca8d466b6adf14ba6578b42e10432932705403e25f61ab06b5b6227c479819a
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHacKZ:3UEtQevvqc2W1cpV2EI32an
TLSH
T1EB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b8a2caf58f247cb4e6c2981a08cc6cadb0ce792251e84cafa1387cc87eb66a0b
MD5 6acffe2ce6f4f4ab7668602d597fe4bc
SHA1 693c57edfd39a165be3802ea4133f013d5b6085e
SHA512 d040bb6fe65d17319696caa3ca8916a56a9024eeade48983e37fd177abbb12bd869b413f2bd35b0dea4744e9639fc72782e4ce68b53e78f5fa14dab62d140cc4
SSDEEP 49152:MCbRquA/m2yL5zQfFiV+XenmE3/zyYPKEnSG:loqtVjnm/YPKES
TLSH
T18DD58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ade81e0bd6b8bb2f3df83e84c99fc4ac0e39eaa3080b9d15a6ceeada42e34b9c
MD5 15501d777165a60043b13f8b305fd9ac
SHA1 78645dec649e21474acff20a1f9409a917a2a13a
SHA512 75d7c9ec4d94b649b248bc2f629d6f56aa1532221bfa556248998ecc4b2fce7b0d7d572bea78d6b066b71b337e646385de70c1cc525a969669928298894d0934
SSDEEP 24576:YAhGLJIFoiwtA5l7S53fYz7KEMdX6keYnAcer+:YAMyFoiq5vYPKEnSG
TLSH
T18F35AE80EBF955D4F5B3AA78A9B68570EA76BCA65E31C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 790698ad8e0b319e68c5d559948173a356562e4964685719c41bed557017c6b0
MD5 a8351b43689db2bf95819b6a3c7770b1
SHA1 09f2740f70af93addcb1166da1808e779e2ab3d6
SHA512 b2a9cc8b7f92bb9d79613535e62e33c9cf57fb5cc7d00b687f828b6307211e3cba1bda56abd0d05a393649d21f16d21fda8036be0d5caa8136482f1990c37f68
SSDEEP 12288:dmw5HEjsChNzBFgl0WDm+Cg45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRki:YwuSOWmYz7KEMdX6keYnAcerP
TLSH
T16885F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6575F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 34b3780f225e6bf29e7ee629f2bcd30eebee06e7bf38f0f2a7a0e3b6d9ccef00
MD5 4a213423420ca154b71cda9a1c730021
SHA1 9598d865397d0ff675ebe3007cf2e46a7cf7edb3
SHA512 afe7404a34a88476b82dcf8e02bf64fbc6dfc568c1186c30b39ff06cc0ef3f6183c509d3f6a04096d4bef1b0925866b4083e8a68089864469d1037a0ad3109ff
SSDEEP 12288:ajZ1Iy945Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkQ:WZuBYz7KEMdX6keYnAcerF
TLSH
T18875124927A860F2E097423EEEF14601D7737893277983CF465892925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0ed2987266f9b3de1cd9ff1b3e544859019a818ae843be1b4a97b6a8ab8637b0
MD5 dd6ecbce5505cabb24490870c9c6cac3
SHA1 c8dd8ea11613cd27e68150df7bd547c24aaf50a8
SHA512 ac82cb5c726b339c610c740a1a0e70f986ee6050692109a973d7fc793b9382ad997c717207d70d4f1bca49c573efbf0a31d127d004c58cabc8fcde6b6c1fe8a1
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:jQRQyi36YOcPQLvw2gAf+PN3MYPKES
TLSH
T103667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 94f33e9573eb4b4c4a35a518125d8d79253cbd8af7bbdd7c0444f17c87468433
MD5 c85e1a4676ff2a84ffe6f67f6fadbe3a
SHA1 29a43d20b2282962a5e3633f5a4dd51e2ecbdc16
SHA512 6f2367653dd4947560b3dab613c3d35bfb245212253ab1a16560739e3412a00dbefafc8f3ad94f1e2daabc2a377e790b351d4b9e79a5aeda9942ecdcbdc8d8dd
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:5QRQyi36YOcPQLvw2gAf+PN3MYPKES
TLSH
T1AD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 22367e13d62e7f9b9de7edeed5916de382a38bea6f40c2559901d494727f6677
MD5 d88805f7d502293f737c6ec31fa552b8
SHA1 0b7692be19e2e2249088210913dc2598ac52d187
SHA512 55b86d108433ed065282cecae686f1f7517b971bdf53ad94dc93baca10593a1d7fbff72b7782b887e1db07b4a2ca049a3a7c9f8eba67fa91eb34629313f4e75b
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0RYz7KEMdX6keYn5:m68Qg55nhheWu7PNU3/iYPKEnSG
TLSH
T12CB55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 eea42de56a35bdf0f7427dd98e8537411bbc35b3d3cefa359d8fc306329843e0
MD5 6db519912f50662e4288f4740577632c
SHA1 c9ec34bf616727e80e0335f545e2fa1ad0741275
SHA512 56d0d7514556a23810c59edc658ee3e5bbeb0c49c6e17884e50008cb90d1e3ec7c08e8ca80c8659f4636fda60840a5bb07be7387b6dc947989bd7b0195089109
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99h:vy5112gYy5azzVvL69nLKnhZFYPKES
TLSH
T1C0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2afbe8601674ecb665c35e5cc48b854db8b22d71da4ffcfdaf88eccbc6404d54
MD5 74102625242a6f63ba7c5f5f6a1f907d
SHA1 309b1fb7f081683c5a37b1d01ca32ba59c05f4af
SHA512 88e2c1139d04a2e8dc2282819a94ff12ede429a4fe2d389918b1ace3f4993760e4c9b8bd1fe1ec9b7fc5f75fcd3261bd04691cab04905f6a31ca859c78254865
SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTYPKEnSG:6u6JmVxd2dTYPKES
TLSH
T101D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 589b57cfc6d0fcccdad4d5146f4f508534ef806adf339e65b36ad6647ea8c3a6
MD5 16ef1ea16fd442469037d1afd998f983
SHA1 d6271a9b9b67dc261bc8e99988bc227428d4ad86
SHA512 e0dc0e018fe81b74509d582f64ab57c079cd79d7d4354e7fa864983cfbd255a770eb72d1ca3a6d69963d0c45a0c8120795db5c3fb9e1e16a681dba65b4cd6daa
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4xoYPKEnSG:YmifPbR/YPKES
TLSH
T1F3B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 15ba13df19a1480ca5f3db5d35be8dd83c24aa6c1302a0b5b40f2f519da3b751
MD5 6662264a3d8c24480c39a7a0bdb7ee5b
SHA1 f9f3a1c0d6c2893faa88533519541e909bc9665c
SHA512 8ffbb4c40b1a8eb18256e283b21fdda8e6d5cd350483a7b2175cec0f68506e926ccccd38057b07b77f8d064962ae842e63b0e0f0042ad5a3d020ac76fa6669fb
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHqBYPKEnSG:r5dKTi61BYPKES
TLSH
T1E3C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2a24d2d9d7b8983ab0eeb0f08c1d58919cb72a03584e065ede06cdd896fcbc64
MD5 1f8588b0114a4885048fae28fbcded7e
SHA1 5714cab2f924238d0c719598413b5b27fb06c4d4
SHA512 77062129170efc4d4447b5913ad36faad48a9d889c4d73900a632ddba5f1f93e947dd86b84993d194e3a708db4ea1400f94e1cb42fba418a607f1d9edd949d8f
SSDEEP 49152:YhtSn8EApI0figngiDn0AP5w0YPKEnSG:JX2iyphzYPKES
TLSH
T19D95BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 20c1c523b42b1e355e4b015ae122bf535d8a86031649b3e50496ea29bb0477a2
MD5 e34155d81817a9d718dea6676a1248db
SHA1 dfd3262f0f3e69c35bd506ac4815cf68eba84bf2
SHA512 8cdae3e353b61b9b2cbf01539b7757d54f47671b54d55597c0f83bb19431b8ffafb8667ab5b408435cab16ca0f0e71d3536f236e471881b4df6cf88f53598039
SSDEEP 12288:KO45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk9:KdYz7KEMdX6keYnAcer8
TLSH
T1596523048E5B8AD2F84A46BBFBF44540C53A6ECB3B8C83A5DD4DF50293FE622450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 4c5438c40078bdda01dbf84747937a07341f3ebaa772c43cd7eed24e630f3e1e
MD5 e584d21ebcfbb3bb11d737ea80b1a5bb
SHA1 9ef7a622e592fb410febefa91707911f6f0ef936
SHA512 3ca7ffbcd48985ed27908efa3bc68f52e0b8e61bcf428b2926d35c2d17fee2eb7f7c915b904eaf506c82a41012e607aa6004380a732de48b0eb2b6d91cdfbbd2
SSDEEP 12288:bh45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk9:buYz7KEMdX6keYnAcer8
TLSH
T1396523048D5B8AD2F84A427BFBB04540C93A6ECB3B8C83A5DD4DF50293FE6324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 9d7aac096bbbbf6a5b46c4daa9e9fe06c4075cea0407f61a084d6f1e413fff3b
MD5 2f852aca0c97ed19c3f705fa17d4c091
SHA1 00279cccf582e117ac0c2aef5cfbf88ca1da6430
SHA512 7e2d07e67cbb3a1b0cf641e2aeaf462fa01e07de3ad50e89795dd5daec581c41c156bc20ca3e1309f3bdf1b98e8aace64ddd19a21dfd0de38e16a72ef072e2aa
SSDEEP 12288:6P45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkC:6gYz7KEMdX6keYnAcerv
TLSH
T1256523048E1B8AC2F84A467BFBB54540C93A6ECB3B8C93A5DD4DF50293FE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 0e12e348b2d8d0401dea845fa895e7099368953e72d2a14220902fc4ba9dbde2
MD5 fdcd96376f69b6c82be2231d20bcd80a
SHA1 947cbd315ed8c0394aa32c583552a2111b3f0cc2
SHA512 c86702d8f87050beed7324afe5a22241dae9d71175079145b222e33134b905e98eebfc34bde74b3d57ab576bfc2b66f754093c5ee1d0f946c8ba5ce697a52770
SSDEEP 12288:2V845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkr:6Yz7KEMdX6keYnAcere
TLSH
T1307523044B5B45C2F85BC27BFEB18500D6767DC63B2893EFCE08A5424BBA3615924B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 d1810cf0a05f5492e5549ae665b59e77284d65945252d8eaffb0d3f58e80787b
MD5 2cbec85f1e2e11189de21129f352a03c
SHA1 57f372767cabb5c27fc89d4a677c01c9c6255138
SHA512 93c6c631be386a35b1ed7aa6cd2e7f21f847c5236e0246a3670ab73e5f760489be6a53f295f6d846113d52c0fd18e6b033c92715ecd656c39a29c334c04ecb58
SSDEEP 12288:Ak45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:AnYz7KEMdX6keYnAcerQ
TLSH
T11E6523048D1B8AD2F84A467BFBA14540C93A6ECB3B8C93A5DD4DF50293FE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 f0675b6013e3615b356c46271bdc26f1a93656b8ecf64e941d66356e123dc591
MD5 007859d926ccd3fb7e9b7811c7d7876d
SHA1 41ffb327a2b97558645b4fd7edb1a1eb81a6dea3
SHA512 a63d45b7d01b0217c96fd45295d5ea6ba2de81e62d4488d35f3242eab5d16ea92de502b6e58c8f9edb07f5f2c8b59a13878f0e88838517c7b86775b0acd9276b
SSDEEP 12288:jl45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:jKYz7KEMdX6keYnAcerQ
TLSH
T1B86523048E5B8AD2F84A427BFBB04540C53A6ECB3B8C93A5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 9c529b2ad78c3ecceec7593b7c3074466607df4609226f53ae35ff77403eeaf7
MD5 92684c7189f7b383914aba64b8dd1ab7
SHA1 bb2304c5bb6d6d17351fc29e64d67672e51824a3
SHA512 a1d1dd274f92815241ef56875e534e6c4f470892f3c18558b90d838853622d84391573183be54b1c9ba2a5d25c0df156e8e100d0e0930b57daa7b266de66a954
SSDEEP 12288:lp45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkZ:l2Yz7KEMdX6keYnAcer4
TLSH
T1716523048D1B8AD2F84A427BFBB44540C53A6ECB3B8C93A5DD4DF54293FE6324505BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 1a98f3dd97a4691f95253cac7afdae197966467d46a35e6fba0a28a967b480b7
MD5 115f838751afd10fe66d8da0c1188536
SHA1 85462eba34a24ef4efd6259c5adb3e422c5ba716
SHA512 69da855df2bdc5a3fb87a118caee628dfac84964a484d17873fee9810b8017ab13b70539eb3184cd60233ef1980f4f67eec7a42b7dc3c1f1329cfdc3b2908231
SSDEEP 12288:2iZwbHzzFEoS2cPvyB45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRki:5ZMTzFVSOOYz7KEMdX6keYnAcerf
TLSH
T14E850194B3500CF0EC67823ECD658906D6B27C5A1B60C65F07A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 b2f503cbfc2cb77bcff5813fb9a8dfb5fe6b8a0158c9afda1c1b9f7b32e7e9c2
MD5 b337f3ddf3d2781f8482dfbec5c548f2
SHA1 4fbe02145527600106f41949d88e72440446addf
SHA512 a304a4c6f0aac64088f570690f2c67b79599b8e1e78ed258b37984a3580c7908841a5dbe96ab86dafec75cc97bd7bf266c093f91aaabb2a95dcafebb8e84bd65
SSDEEP 12288:Dq45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRku:DxYz7KEMdX6keYnAcerD
TLSH
T1236523088D1B8AD2F84A427BFBA54540C93A6ECB3B8C93E1DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 87e5d92ea66f4d6f05dd9c866975fedaa6e4ee857b8477fb9a60e6d891b189f4
MD5 5275ffc8471f493d40e2361597aa16ad
SHA1 6f657d89e1f2acb360defa2b3c3a465eae82727b
SHA512 fa2358aae380a655b54ec0791cbf0325ca6e657a39ea72fe4ec85582a7c213755e8b2683f7a180d240bf6fe4e4b61604b746bf78e68fc2219665b88932ed3229
SSDEEP 12288:Pm45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRku:P1Yz7KEMdX6keYnAcerD
TLSH
T1726523048D5B8AD2F84A427BFBA44540C93A6ECB3B8C93E5DD4DF50293FE63245057AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 47bc249c33078e94e5060204a7eccf916e9ea924e4974f51ef30f6a639825a0b
MD5 801a6de0f2ffc31106509f7c50d2d666
SHA1 c9e7b24e75cf53c6e2ca1652a89c98a73f4663a5
SHA512 118689b2e3c61e9933b56f4709bef65a029b741a421bc3257d3e02924282b294be8be5e35b3840626395afb7d70d2bf96f6a7e1ddbc120509dd0793313c606f4
SSDEEP 12288:qyPz5L8945Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:3zyCYz7KEMdX6keYnAcerv
TLSH
T17575120767A630F5E0278239DDA10A01F77278761B248BAF579447732F7B3A19D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 1604378b9f61ba1bd37a793d23a7eedfbb4744dbfa1acc645d5cdcc0c4af684a
MD5 6fbc667db8e49a9184202a9c14bcc898
SHA1 509d76cc2bd7ee2ebbad77468612dc417d4c984c
SHA512 462f98d746cfe74429aa0752a1ba5f858dfa0fb4165d01af3a783ea18e337c9ac69fb6da22ef67994be739e9766161cb13311dcd18942ca4c859d55cafb5d787
SSDEEP 12288:Nq45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkK:NxYz7KEMdX6keYnAcerf
TLSH
T1786523088D1B8AD2F84A427BFBB54540C93A6ECB3B8C93E5DD4DF50293FE622450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 23af047e562f49d3f1adcfeb3a60e49c39e495939062530ef9fbdd82e7a58333
MD5 66cfdbaa441818e4419e4e5f5e80d734
SHA1 a246741c46f87fb4259687d129a336d6cb44cff4
SHA512 f809df207e3fd1bce737f2be5d1eb80aa487c78ef8d6a7150c0190b3acc098923ec6403d284be48ce11aac2e6a095bc01a635ae3701f71f32a16fee24be8bac8
SSDEEP 12288:Jq45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkK:JxYz7KEMdX6keYnAcerf
TLSH
T14C6523088D1B8AD2F84A467BFBA44540C93A6ECB3B8C93E5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5938d621c25b33a68e34959d00319ecf2dfe576c1dba541857f96207b7771f29
MD5 ee5d299a79df3de11623fc6724c4151c
SHA1 b9fb7c51acbd022f8ebae4985b752c88a6f33489
SHA512 7576e1dc40b51f804168bf0c6a450a447aafffb8868d32e32d4d77b43397d33f6e20b78c9f1fff32aa4748e682b7e444861b0a47cfd5922daf627009d53912c9
SSDEEP 12288:3yPz5L8945Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkI:6zyCYz7KEMdX6keYnAcerB
TLSH
T12C75120767A630F5E0278239DDA10A01F77278761B248BAF579447732F7B3A19D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f31dba69d141a71a0ccfd743756138c24a991d18b9f468b1a84540ef809446b0
MD5 bd75efdebf1ef0613c9df1585ed19073
SHA1 5e5df1ff719b143170e32dec05aee361ef97f1c8
SHA512 6d29d38056c8e1c7e81490536aa4b34eb23509c9ee42a0fae6ff21f1f524aa59f09e9ce66fa19c156cf4e5519e22d8b08e49455c76dade0796702d1ea5752a6f
SSDEEP 12288:zCd9ZWYoaLHF3z0z04PDvhf45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk8:+TIaLl3z0zDwYz7KEMdX6keYnAcer9
TLSH
T106850194B3501CF4EC67823ECD658906D6B27C5A0B70C65F07A836675F373A11C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 92970f9b03d74316a518195c814c9d611b6e58159487322db60371ca262a29ff
MD5 f69827a72bb294af9a93f08bd0b8d14f
SHA1 4cd60364fa5c9f072f4b24aed102fac9e8d3ffb5
SHA512 a4a8496430fab151b9074468a56f1a29849774335f23ff3ef74d481bf0b0542a1a6ee1463e7fe753b6416a8218ccda89d8254c5b1072a94955e3beb016e3fd84
SSDEEP 12288:7i4e7wRdTfgwCHKy7GLbbdIvI45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk2:735d9CHKy7GZsYz7KEMdX6keYnAcerz
TLSH
T1FB95CF90F3E414E4F0B78A35DD764511DAB67C9A1B21DA8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 37f45043f68171c0d3334cb984bae7d7f474c74164b04b7fe541c6a20db484bb
MD5 d313708e58b1cf418a5a17d1342343ab
SHA1 0581e6965548ccd336e6dcd22695ea0a8f839e4a
SHA512 e05d457f84de9db4b6afbf2a61ecf18a6f78f1a086aa9278591c6daf3f2c9e0019ab7811fadcfc56815fffbcb0860cae48d7c2c368880d8f0e235fa9193f89f2
SSDEEP 12288:+v45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk4:+AYz7KEMdX6keYnAcerx
TLSH
T1BF6523048D1B8AC2F84A467BFBA54540C93A6ECB3B8C93A5DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 11d1125deb2eac9f2e11e9452e5d625e04215d86029e4660e1c340eaf55cc889
MD5 7a31d35097788f56975897ea137e2c94
SHA1 464cf702d75e1367c750bd8288c1a09a681c3e55
SHA512 5aecd258c162690ebf6defc4594da4fdc7c1744899de19ae4a2292554625109bfa7a88dbc6f0eba6eb2a07e41837823363e06cec80692aae5bfee92580af781d
SSDEEP 12288:5zsf645Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkZ:ABYz7KEMdX6keYnAcerQ
TLSH
T147750109C29802E4D06E527ADB954A40F3337CA657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 cc931c688ffd5240533d0bcac685cacb3a28286e44c006ab9f840efbf28f4260
MD5 c9e9c3b5702be5a0f67c5879fd914220
SHA1 d768e208f72e79eef978c3c6681db7d457d5ae84
SHA512 e9253da7bd0e8a9004fdd7eca0486aa9aa89e2d03b3de0a6e5685072625f0e0fdb5e8c8225be0d26f39d2a737f8afee5554972fe56dda48faec29c9f1d0237ef
SSDEEP 12288:9945Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk7:9CYz7KEMdX6keYnAcera
TLSH
T193752304875E8DC2F86E4677BAB58520953E7DCA2F4882D3E84CB242937E6E18D3574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3812a394ccf3dbdfeab8f8c534767de60b0999fc6bc451d8910fa5ee6357ac9f
MD5 7cbf3b4aa6da97b0fe4be0793a1b7906
SHA1 82f7c79648789849b65ff00a67c21d548d1c85eb
SHA512 ce4bf64a4bd86037193eae4576db46c2fd104a8b5bbb1395c3a85d585a9186d0a29bd77e1c8d9162179d86b3c5445ad05f07e4e8a6c3bb827721ea21a3985215
SSDEEP 24576:N8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCgYz7KEMdX6keYnAcerO:yRZwQCyiHiQEaaPnMbYPKEnSG
TLSH
T18285AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27D1F2BEF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 bd75fb8dce7448a0f61a965b7974a15a37f8c8a70ee9e002c1b2ce94c3ce6312
MD5 1dc0607991f38df7b88ae5a3e386962e
SHA1 0cedb1053160e9d20b44f3e013b1ece618e8a1c3
SHA512 9fdeb424d305095c7dc0ff1a854bfc063686378f8b3cac0b00cf908916ed21bfd671f9a4803e3f9f1fe15a8fbe92f5bf34f04045c1de5377f093cf2532469e0c
SSDEEP 12288:qbxA1U7KU45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:qbxA1UGXYz7KEMdX6keYnAcerX
TLSH
T11775122E56AD18E1F47A923EEAE18101C3327C56272493EF5484C27A4F3BEE55C35F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1f1bec5ebd8dc88eb1ac28209e2d23df2ac6b0c74243d33dd60e73d181674bf0
MD5 c2aca12e731224dc03daa4c94f890b35
SHA1 f8811499a3f21dbd543916d9eb3bb2b1eb83ae51
SHA512 13990e1b006f3d0cf0527844c4fbefe3ec685615fd5c128fa42c0002baf167324838ba6952dcd895b51e10b71de8dd53d76f62423d1216b6d0404ff70b6f3dd8
SSDEEP 24576:4jsmP0yHaqrVqHra44KDzMsrnQYz7KEMdX6keYnAcerp:4jRP0yHfVqzlAsrnQYPKEnSG
TLSH
T13F45AF2EF2B910F9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 e7dd0ac2e1052183a9457e7f9387417a7a35bf4a82d73d0e87d3e218f2e86cbf
MD5 f38f34da254bbc2ce172b5b7cbb0e998
SHA1 7f090afe9920f66cbb689bd9607b8260a6ffa906
SHA512 6e8f46ebe0ae10652295cfeb53c1ec216dd819270001f2f740a9d503f88d0e432b908fbaeb10b608f128f59f5a15ca6c3ded0d890d045bedcd6da640b6cde7c3
SSDEEP 12288:ZH45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:ZYYz7KEMdX6keYnAcerj
TLSH
T1577523048A0B8AC2F85A467BFBA48500853A7EC63B5C53E3DC4DF54293BE6B3453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a20997ea6452b7f30338ebc8165aae45cb46276effcd2e4acada11ec85bb257c
MD5 42b2b312fdd2f900afd8709dd1a4e209
SHA1 47f1bad0292f7baa1c6d14f4b6df5dc8e9401a39
SHA512 9ae2e9d047cb79aa6071d355f57f92ecd11c00c243fb93221aad85a4b81feb952bf11c8d8b0164c4c9d54500fb3d3b7ffcdca6e981b9abdca8cbb0e31d164bc2
SSDEEP 12288:4ObMA4LWO+vAYFTZ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkg:VMLBUTmYz7KEMdX6keYnAcerF
TLSH
T1AB950114E79500F5E86BC13DC9B28A12D272B89D1764E7DF03A88B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 d61eca9f9b5dc790db69128269887e6fd8848cec24e2ba1c48c3af97a557d1e7
MD5 242829c75e9e5c0ac70a612a602615bb
SHA1 ae905e5f5c53a142b84b39d53b3bd7ccf78ff054
SHA512 c8518b4d0e581434fed0788a9f67609980bdd640f711dd39f77f7fedd843c9650608f6171640e631c16fcd9aefbe2832bd93f5ce43e7cc4cd3d1e46262fe5fe7
SSDEEP 12288:B70VmKIYNvUyBp845Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkq:eGYNHBYz7KEMdX6keYnAcerH
TLSH
T11785F11E52AD0CE1E57B917ECAC28205F2737896171593DF05A0C27A1F27EE9BC3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fbd9c97051104230813cddd02b5b15fb27ffe360c7fc9f217b7a472c6d5d3fef
MD5 9757b27ee909e54bb01b9c4efda4e2ec
SHA1 d87012ccbde048c86dd9a588af394c11857aae6c
SHA512 19d198f02595bde612977214ca9408eeaf044070f7b321fbf194dea8c4fc8dd8443b000a82d1012ab38f5c61ac2be83c2409da03a0d4186abdaaaaa0254994b8
SSDEEP 24576:inXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK3:inXoJJYH84VVS6AmEcJas+cHBjSSKHPH
TLSH
T1BA65BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5e74ecac63ad490187dba2116b95a7da566d5dc9f1dc7e93cefec40f2e73a1a5
MD5 beb5deb191b3337ce4b018072995b434
SHA1 61d5bf43dfa8b08cad9c61378621808aa830aba0
SHA512 1c4f7c599f9fd20632e4c170c55e9384f6099d1e9d19802b6bdb85546bcdfbf7fb0f17562b172591b548ceabcc398cbf7db05814314fa8deb7ecfcecbb370570
SSDEEP 24576:5v7Xbxd9Tuycf8M/TYlSuxwr2PC3Yz7KEMdX6keYnAcerk:5DLL9TuJ0M/TYW2P4YPKEnSG
TLSH
T104858D5EA2EC42D4E47BD6BD85B79046FAB2B855273081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 87993619718fd5389aea0cb2174de5478a1477f9a6f53ba889245b9c9c399ac2
MD5 26cfcd3a0dfeb672cd8c557fc1e6a8bb
SHA1 9599edad8e8c3981dc6f705885b13953c55adf29
SHA512 b3771464a472ec0a64b020fff15159efb9dc8abc93d55a6ae92ab0dfba9ae73d8e3bba1899cfae2b54d078e53ec1ec59ff2b9e4089195c3abc8a5561b6526f37
SSDEEP 24576:wegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wmYz7KEMdX6keYnAcer7:wngOJOmPOHhmYPKEnSG
TLSH
T1E655CF3FA7BC15D5E03EC17ECA928916F6B1782613255ACF0560827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 29cafdf7fc2698b35f0a0659587caca92ae64b55fb6e3cc6d948a88687c53e4b
MD5 9c3452757172cbb2d62ebfe3ef46e1ba
SHA1 525219b4f37139d0279bb5548d604df846960939
SHA512 02fbd330ee933710549036cbb8ae37321755543191afc81b27bcdb1fb89462d863c015e2e63a500c284fef9c021d2d4d75d83df3c324f3bf812c671bdcac79c8
SSDEEP 24576:WLJnJiTk3R3waE4JrO4Yz7KEMdX6keYnAcerR:WLJnJK8R304ldYPKEnSG
TLSH
T13B85D02CD2A910E4E4B7C2B4825A1756FF32346D2F2569CB59B4D5313F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e3165761d38f50d727a82fc427453fc6956e6eea1f91d9ff18a46f09d292573b
MD5 a879ea463be29ad4c2ad3bf93e43c1ec
SHA1 f2d2f2c14e65e3a62f63f6badfbf60f9ceb94873
SHA512 d3d9abad2b9005d070ff22c9b17d476142c971a6db474e43db0e623fd392621b09fe056999a8be7fb0dedd28e8de46e69b0c4067d5727124bc5f235ac690c7e3
SSDEEP 24576:SA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6peYz7KEMdX6keYnAcer2:t9GqCzDScAZmlvTcFg8Ph6UYPKEnSG
TLSH
T1E5955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 ddfd574914e35c5d99b1eb4bb200c4333baf4fd3f9ee6291d6eec1b05dbe3d2b
MD5 170c3bf2f66c63e6ba8b9f3445d142c4
SHA1 3e22bd35895d7666807431604159f9b79859ecc5
SHA512 919339be9db3e6fff2ba089c16c4b8cde4d6342b27dd457a25243141a2f531db47a98aed9628ff4fbeeb4d9bb5971ee3e136af820e9499999e463a751de00c4d
SSDEEP 12288:3lYJeXm5nkEUuEY45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkh:3lYJeXm5jUuEzYz7KEMdX6keYnAcerI
TLSH
T1CE75120C669D70E1F02E817EEAA14900D372F4A6274553FF85D4D2768F6BAE21E39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 4326b98340b0e71fe13ed61d79c4a51dbb10edd9c4ae0cbdade7a5cdca3558e8
MD5 15e3dd115a9e89e0e887aab4d5caa63e
SHA1 53457e2c53dfaa684d26cc10dcf3de070a6e21b4
SHA512 ba33aa645cf8d56f81dd5ee92f43f4662e05578e3d2fdb34635bae08d79b11bf7df7908b1f2effac5cfddca2e8f1a31003b8085776efe7e48160a49e422508fd
SSDEEP 12288:qCu6kye45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkV:qHtytYz7KEMdX6keYnAcerM
TLSH
T116751204579555D0F8BA4639EEB28150CE36BC612F1483EF94C0F62F6F7A7E1A830B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 6b8804c169264c7d9bfc7150def8af4262110420334200a004f6458c8e361b04
MD5 28c0087ce50f891c5d4e8021822684de
SHA1 2123742d9134c2fffc44fbe7467e3b7427171fd3
SHA512 1b6e69866e8065ddda578f8c1ee65148cf7f91b89c4a2e431abdd7a9720dc1fec8a230f1c16e08db505550e44f3f137c8cf23733cd88c7c89ffb62fb5d6008e7
SSDEEP 12288:APZ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRks:AmYz7KEMdX6keYnAcerN
TLSH
T15E75230C461B59D2F80A467BFAB14540C53A7ED63B5852FB98CCF162C7BE2A24531F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 53807ab1c82fb01bab1ebdf26ecba4883e7b4fb15a42ebda6d49ad2f4387888d
MD5 e88627b30da09abf258ccc29ccc5e7c7
SHA1 f152e85d1d83652102ceb515e4ad2283b00f48cc
SHA512 554f5bc69f3450296ff3c3dcf991c3959ed0cbf211cf6951c59497ee001d2587b1998c49245dbfb523f58e1bccfc0b5a647b48660f4643cefae1c8ed14b56643
SSDEEP 24576:+C+TyQIu93VAumZr7jmTYz7KEMdX6keYnAcer6:+/TfIq+YTYPKEnSG
TLSH
T12A558D1DA7E91DCAE176C675C8A34493E633B872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 b80d38c7e8bdf21a8b3e74f6d4e93ffdcf7b1ec0ca83ce0f7309003eae29837c
MD5 dec719e59d990e8a3fefc9d15d85906c
SHA1 fedc0bcf7967c046fdbb5e4f74db4e7e113e4b44
SHA512 2befd8c93a7f0381c0928c7f26ec32fe71b3a4a3015da0caa1fce58d2cef4f85b0758dbf1bb95b7eb358aad115344da67442f10cd824d90f0f9c8168e720855f
SSDEEP 12288:PcyrWOstaa3kcs145Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:2LQikZaYz7KEMdX6keYnAcerQ
TLSH
T16885F10EB3AF00A1E4ABC23DC9954111F6737475171263DF4690C77A4BAB6EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7dcb06a17f29c855fd069e81078991bdfc5a82efa43162f3390fdeb34a122789
MD5 933df3e41bafc830ae861f66d5f2bebb
SHA1 296dcad5dac29da2e6ac9aab1bdddb13d01f664e
SHA512 eff696bf5af148205c48d16d7f3e9380e23f8c0826acd3ea46d3e732fed3de3daec60b273288aeb97406fd28bc5c444e0d4327c794966d92bf4b21b82ae35f88
SSDEEP 49152:EpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPtYPKEnSG:FpC7b4+80GTkcYPKES
TLSH
T1A7A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f71f0edb95bb6faedeacd429d4107d2ff5e31bc2277049b526f1c8e4597b0ab6
MD5 e7178bb2dee5a5b99f3b02b229a6f5b3
SHA1 c67546f9c6dc0b7c1db3c3e499b8e517798b33d3
SHA512 d9b01a86cbcea9b158e21b6eb3201003cf3daf4da4380a1d2583f415de024ef3d4ff440729e617c18d75c340cabb3fda6c8e39662eab5c04b43f65b366ef1b5c
SSDEEP 24576:2SAwJPE1IDAo+4Kt+l44135UQIYz7KEMdX6keYnAcerf:2qPCIo4Kol4/QIYPKEnSG
TLSH
T1E555AF29A7F946E5E17AC7B5D663C601FB727822133163CF9290813E0F16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-346-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/924-504-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1964-234-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1964-12-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2004-438-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/2004-359-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2004-393-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/2004-563-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2004-365-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2004-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2004-377-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/2080-240-0x0000000000EE0000-0x0000000000F8E000-memory.dmp

Download

memory/2080-52-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/2080-239-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2080-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2080-58-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/2544-238-0x00000292E5140000-0x00000292E51EE000-memory.dmp

Download

memory/2796-354-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/2796-281-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2796-275-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2796-283-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3040-77-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3040-83-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3040-94-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/3152-350-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3152-508-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3180-329-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/3224-446-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3224-324-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3224-318-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3224-328-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3332-441-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/3332-299-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/3536-41-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/3536-13-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3536-19-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3536-32-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/3536-38-0x00000000007A0000-0x000000000084E000-memory.dmp

Download

memory/3536-35-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3584-461-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-467-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-474-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-475-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-471-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-470-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-476-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-478-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-479-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-480-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-451-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-469-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-468-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-477-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-473-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-466-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-463-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-472-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-452-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-460-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-464-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-459-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-465-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-462-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-454-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-453-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-456-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-458-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3584-455-0x000001AC99990000-0x000001AC999A0000-memory.dmp

Download

memory/3620-349-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3620-271-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3652-332-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3652-447-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3704-337-0x0000000000550000-0x00000000005A6000-memory.dmp

Download

memory/3704-338-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3704-335-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3768-0-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3768-42-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3768-6-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3768-10-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/3768-85-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/3768-46-0x0000000000760000-0x000000000080E000-memory.dmp

Download

memory/3812-326-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3812-457-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3812-442-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3984-40-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3984-43-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4124-34-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4124-24-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4124-250-0x0000000000C10000-0x0000000000CBE000-memory.dmp

Download

memory/4124-237-0x0000000000C10000-0x0000000000CBE000-memory.dmp

Download

memory/4124-30-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4564-450-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4564-341-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4756-295-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/4756-289-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/4756-367-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/4756-286-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/4856-355-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/4856-546-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/4928-307-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4928-313-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4928-327-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4928-445-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4968-71-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4968-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4968-75-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4968-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4968-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download