bd1cce2868068d45795c8f166145f19fa0a6bbb16943a55532959d2dc4fd823b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Size 12.3MB
Sample260511-qrlmmsaz91
SHA256 bd1cce2868068d45795c8f166145f19fa0a6bbb16943a55532959d2dc4fd823b
MD5 4400fe8681ef521dbdc17d373246de38
SHA1 b4dd48e7c77f8822fb6d583098fad13020fe18f8
SHA512 ad52788b5a5f0e59c40588f8d7633ccc3792885a9850d92e991514e321e361248a144e6f56e0981e867618045bc020e5a5e9a8c625fc94f81c5e4958c433323a
SSDEEP 196608:Thr1I2WcqSjj7UlG8drCeqBvKCzcLXcKZ:Thr1tqSP7UlZdrWlDzcLXn
TLSH
T1DDD65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2832	alg.exe
4512	DiagnosticsHub.StandardCollector.Service.exe
4912	fxssvc.exe
1100	elevation_service.exe
3724	elevation_service.exe
1440	maintenanceservice.exe
2412	OSE.EXE
5196	msdtc.exe
1632	PerceptionSimulationService.exe
4916	perfhost.exe
1740	locator.exe
5880	SensorDataService.exe
5304	snmptrap.exe
4340	spectrum.exe
2252	ssh-agent.exe
3852	TieringEngineService.exe
5936	AgentService.exe
2068	vds.exe
4652	vssvc.exe
1964	wbengine.exe
1588	WmiApSrv.exe
5172	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7464e8e78b62accd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b295d7904ae1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f01033904ae1dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c45e8904ae1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022383a904ae1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4512	DiagnosticsHub.StandardCollector.Service.exe
4512	DiagnosticsHub.StandardCollector.Service.exe
4512	DiagnosticsHub.StandardCollector.Service.exe
4512	DiagnosticsHub.StandardCollector.Service.exe
4512	DiagnosticsHub.StandardCollector.Service.exe
4512	DiagnosticsHub.StandardCollector.Service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4228	2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	4912	fxssvc.exe
Token: SeDebugPrivilege	4512	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1100	elevation_service.exe
Token: SeRestorePrivilege	3852	TieringEngineService.exe
Token: SeManageVolumePrivilege	3852	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5936	AgentService.exe
Token: SeBackupPrivilege	4652	vssvc.exe
Token: SeRestorePrivilege	4652	vssvc.exe
Token: SeAuditPrivilege	4652	vssvc.exe
Token: SeBackupPrivilege	1964	wbengine.exe
Token: SeRestorePrivilege	1964	wbengine.exe
Token: SeSecurityPrivilege	1964	wbengine.exe
Token: 33	5172	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5172	SearchIndexer.exe
Token: SeDebugPrivilege	1100	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4228	2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4228	2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5560	4228	2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe	80
PID 5172 wrote to memory of 2928	5172	SearchIndexer.exe	105
PID 5172 wrote to memory of 4504	5172	SearchIndexer.exe	106
PID 5172 wrote to memory of 1488	5172	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-11_4400fe8681ef521dbdc17d373246de38_akira_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar.exe" --type=collab-renderer --proc=4228
  2⤵
  PID:5560

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5332

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3724

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1440

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1632

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1740

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5880

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5304

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4340

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3360

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5936

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2928
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2848 2836 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2864 2824 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fde5e966475b21ea6623084412914a08cea766eb920b9abab088779c2060d7c6
MD5 b24a92d6f4efa51fcbf5af63ed72970b
SHA1 ba86e6a762ff4035ba8d184eb3dd94e2d1ef5a2d
SHA512 b955fa2b3cf6acdfd8e681e2b5b2c5b3bbcfda10e4518a93d11dee1e08a0ad2133714315ffbf3dfb8ce8b575c5f9b8dad1f14e289ca990f0c82df9ae04e505c8
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCYPKEnSG:/3q6HjBXYPKES
TLSH
T159D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3a3ba1fedd3540de84841fddafadc8db515b343d3caeb4afa8c3aefc7e90e538
MD5 d4cc47e55e120f0278f6e7c0de5543a6
SHA1 01217e4160a2d8c92fa71d24788ddecb88ee4374
SHA512 f357c65758dc0c36d5ce66dbabd3efb44c8f1e4c2b0e0d5b88e5a87922a64b23af403d320dc399529e2399bcfd174b9e961820ce55b21c0dd831ef3d0b7e5a05
SSDEEP 12288:U1XLsswWkxy2lRq2czAg45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk0:yXYfDtczAbYz7KEMdX6keYnAcer5
TLSH
T11C85012867D508F5EC6B823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9534314c7610373f0c21e5a10503ce90fa127d928e2d66c5289c76b5c7e431ed
MD5 20b48e6bd73c6d8aec251ab77b9e49cd
SHA1 cb1b2e901fb18584bc1a0730d0f70507af680beb
SHA512 441e48a0f5c5a059910d9e85e6281523c95b9ef844dfa6022de9bd9f4e781be524b25f0442bfead22c7cdb407f073781f1ae59a0426ed802adcdf6e9d3f320be
SSDEEP 24576:S0Le5ji0hmx3rM6Yz7KEMdX6keYnAcere:SPji0AZZYPKEnSG
TLSH
T1F4A59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5d49d2a3011bdaaa8e3aa6bbc66b58d58349b46efbeecf086f41c2632b0082a8
MD5 7881144fd30afe8a78e434ad60157a63
SHA1 631dc485fa33c6a075f7e2ca7e12c6ed7f0e8c54
SHA512 739f21b57fae94dc12c709c4b1f783b0bb1608f2403f8712df4e635f296837889ed2030bb7f6612fc8e7f124db80b433ed81e2188aca48d2e217d009b478abf2
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyusYz7KEMdX6keYnAcerN:1/ezSC6vUzPvxHjy9YPKEnSG
TLSH
T1BB756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 384786720642f125f89fe049790f2f7d50d22241b9c71d560e2334d6d306beda
MD5 cd45e264e97643b42cf2fe216a5b1222
SHA1 dca4e43ee33d3106cee3464df3af19b201be41ec
SHA512 cbeaab0cfec81661536a4457eb922e0f9c753f54342eacf7dc2850144f3c4877bc53c2871b7f3003d2709145c38364eec57f1873cb79e2886496bde6c7d8261c
SSDEEP 24576:pVbqPb88hv/l+6HYz7KEMdX6keYnAcer5:pVO88hXl++YPKEnSG
TLSH
T1AE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 e75ee4550ca36ba294a5c370f145714ae6ab66b6e303b580948d6cfd618801ed
MD5 6535202a86318336aaaef86aff068511
SHA1 cb573f9a6dc5f6e7841de08160428207bb962b89
SHA512 a91f222a8a293b4c0de9f979bbc129bee8979fb4d66126ddf41b75bd41cb3b28c7924a097aec3d1a6964487b8c7995d2f609b4a2ce800b34fd57399839dfd6fd
SSDEEP 12288:HX545Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkD:HXGYz7KEMdX6keYnAceru
TLSH
T1B16523048B1A89D2F85F4677FFF5894085375DC62E8C9761C94CFA8293BE222C50679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 e8c3e673eab7dbdeab55380111ff37e78149c4b793beca4393210496c2721cef
MD5 407f22fdb42f1eb32e470e0d76321d85
SHA1 d42ce11803caf948948ff6006fcb416edcbff80a
SHA512 f7787a7a8e479b3d33e37c32d7aa3ae5172254260a7db611766a35d1425e334a339ab9d7c0bda50dc6755107839ba098a13d154a6abf411066b92524c24ad9fb
SSDEEP 12288:4eBNUbTVO86Uc45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk/:4JIUfYz7KEMdX6keYnAcer6
TLSH
T15385CF3BEE28FCD2C27E8DB96B918600D77278704B51A3CBD165820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 56614233d46616265287fef1f4d336194872d9def5e28a1b8cacebec9ee51c19
MD5 67eb228db7472bff908e373d9a92b8f2
SHA1 d9069a3592403fcd32b7fb6fdd4c37389d87b543
SHA512 3db16d98fecb91f41fd5ac4b07366c03d00741724b66d27e2ce9b63d4c24a536cc5e373b855dcf1ee2b5793da961f9741ae8c35848d87b9dc43cc5862518f3b6
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:bQvGAdlCEL8c/yRNw5CcYPKES
TLSH
T19A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 33ca4e51139fb5c7a730e2e766ead3c0f8032d6f3bed83362200b2fa46872d1c
MD5 5dd3fc89533d7099d0fac7952ac27699
SHA1 4aa9ad818d785a865384d305d21caa461125a7eb
SHA512 f1f77a831d59284235c77e21e3e4533ae4ae945c9acece4cdb3ec11414da580d380ae71399ea188c2007c325c69cbeab98fcff32c99b16e3f1358a178368e9b0
SSDEEP 12288:5AwSfxL/2Dc3BDLLmt0LDQewsAjC45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkJ:qkewsAjJYz7KEMdX6keYnAcerU
TLSH
T15895E031FE75E432C67F0DB62B36C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 876d844f47f7fae9ae3596674221fa35a5bea4e3185fa1dada811e43265ba549
MD5 cc13285e82f9244cade2492ffc79796d
SHA1 9593b9b0caa99b8f13f4b6ee0b1045b7d48f8948
SHA512 49c8a5c0daaa19a30a13d853b038ec49ee24c74a7b860c3fa15f9e7ba41d4cff6d51184cc629018f1271052aed9778cd09caf84235f3f6b582773e4a4446aa55
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHRcKZ:JUEtQevvqc2W1cpV2EI32Rn
TLSH
T1EB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 73e0702950ed53eeb68a3d3e46858a3a004cbfc3043956d65e5b37a14a5b4035
MD5 063d2aeb664b8c4dae84405f3bb51767
SHA1 8037efc3b2933374fc6e8b47d54e7007fd69dcf1
SHA512 e0d40d5ca0000d440cf28b8d37d3ef0d89a8b69d0340c2dd10e10b9434cf3f6f05d9211148158cad79ecea78ccff3134da27692353ab850012dab620c8ba3c97
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zpYPKEnSG:PoqtVjnmAYPKES
TLSH
T194D58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 572bde5135dec00785c53c52002054c097c50168d3599202134cd944fee089e1
MD5 3333da59d1e71db3af7e1492489910f5
SHA1 86d0fcd0109c70963cde4c55a3dc7e5775448c1a
SHA512 2987371018067536045eca36b44aa5111bb50957629a9bd5916732eaf6b2198cb90681bc9dbd4685d68fa0c40a5862fdc995b457f754040a1004ee8f93477f6f
SSDEEP 24576:4AhGLJIFoiwtA5l7S53gYz7KEMdX6keYnAcerE:4AMyFoiq5wYPKEnSG
TLSH
T1FD35AE80EBF955D4F5B3AA78A9B68571EA76BCA65E30C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 80cc5efb64f0023758b5f2aec877a0da9acf6427f5ea9e7b77429f1a080b11aa
MD5 7223bc94d78673d32a39e71ec1337230
SHA1 c2d4d58f8aa2f2f5e001c6ea5765db5a0300a54a
SHA512 020e24a2e01fb53c664fabb1c8f1681781a5a182d44ac3edb7c1e80c8b3a38f402286864dfedd6c0c523b6d9458be5c124c0889bddbb54362371583eddc5a97c
SSDEEP 12288:Gmw5HEjsChNzBFgl0WDm+Cj45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:fwuSOWdYz7KEMdX6keYnAcerU
TLSH
T19A85F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6576F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f9d8f85101a0f3ca6d9ddee3b1778c0395ffa25256d02aabbdae174f57206009
MD5 895a3bbd216418a7ca166f00b89e15c8
SHA1 4a33a4ef433940643dcbc64f2aa1d0adb26b8de9
SHA512 a2d89113f2b139a43c3c4c7ec64b99a9bc4d0c3e972c92b31df128bf7ccdb2e59ba803599c81665a8bd60884f13f9c66865908a3418bf2791e34b6613fd79250
SSDEEP 12288:ajZ1Iyy45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkT:WZuyYz7KEMdX6keYnAcerm
TLSH
T10375124927A820F2F0A7423EEEF14601D7727893277983CF465896925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a129c4ba61e2d0b6a03661440647c57808186f582bceb92a4c52d9ef7dd40461
MD5 ba5b810710ac1e8bd326cf297a42f2d5
SHA1 10835eb075eff047563648286f3cb937f4102a67
SHA512 1e4c87489bdb3495dfb7c32d9485936025bcc24bee031cabdf5c56852de2cd3d4ce6660a7615f47491f2460786440f8a2a2f0a3c20e934f34b618b21dec09bf7
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:rQRQyi36YOcPQLvw2gAf+PN3zYPKES
TLSH
T195667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6f1528f868ea1f866f909c2b93a5805e3f18a86b992282a17ecb351a5f11a86e
MD5 60e99b21a2a537e6059ebbed7cc60b02
SHA1 91a3d50e8f9b61767f2dcf4bb96ca1df310022b9
SHA512 117b7e52479b7d6ac9d52def9d46be88d2106c83d0ffe5c4d4d8b2416537749cde059628e504b33b2555cbb672860d9b9db294956e77cc7563acfbf7c0f4470f
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:rQRQyi36YOcPQLvw2gAf+PN3zYPKES
TLSH
T1A5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 83dce07c294b8033226468f5ab42872d30abaee07a7a4f9e34d280a03ae8e417
MD5 4cbdc0d3f3068bc114c1eb36cc02f614
SHA1 ac3b3d955d3936600e4fb6f9c353076799bae906
SHA512 e9bd994dcbaab80596367124221b9c62aa81ae0829a59084bf841547eddca9f470ce293c6a3923eccc801fd4a27896f2c4d054811d1acbaa7d0718c0fd76ad18
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0CYz7KEMdX6keYni:868Qg55nhheWu7PNU3/ZYPKEnSG
TLSH
T144B55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6a4476438b1a170997a605ff6d38d2971baed01be8f20f38c97fdd55331b9bee
MD5 09ac402b3bcbb6256bfec3db86cef1a5
SHA1 95c79492867919210273af032c817ea412dfccaf
SHA512 bd1614a03c6bd89964a5a3369285aaf46fe37b71ab75943346059568f42b133099ed7d66ccfce316618f9225b2dd9ee82108f1dbfc37377298039f807bea50ad
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99c:ry5112gYy5azzVvL69nLKnhZGYPKES
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dce6997a17a752fc8c6cfe7a3aafd7578bd9b846a4a447cb3537b482e13b435c
MD5 5c22f42e761786fdef3ed4c6112499e2
SHA1 39dbca445e213e4ebc0f9292acdc3de15e0cde85
SHA512 a09acb68e34fd83a20a3ba4de93e01cd997a764d2b4001d7d2965b8d573054a02d218b600048e3e4eb5ae3de8b5fd6888389e9e8af7967a4806f3316eec89203
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glrYPKEnSG:Mu6JmVxd2drYPKES
TLSH
T16BD59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 99b8e7e2d50ea03a608d3b038651383dd676d9fab1bf76ea5c04eb92bc06b20d
MD5 e710a4d3e7c9d62f132b0acb5928baef
SHA1 56da32cc2fcee94608c13934e4535a6665b54445
SHA512 c4901cf1a551ece6d8ad42175e648cb4f0efaa4d68f44ca45e44db6bb09a6de8b467e6b35129c95882321ccd6c9e61dac52244ab0ab3b189fb9fb4e9418f0c34
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4x/YPKEnSG:amifPbRAYPKES
TLSH
T12EB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8efe38a9af0929c72b19e23d5d31406b6d4170918e05c923a3e0f489a4c78372
MD5 f19e22dbd605c3e1ed33a0431be59daf
SHA1 816c954924ae8c3a0a0813e7f5d2b9e2c440d908
SHA512 a0ae79d0e58e6732e2187d375024cd263f01ab828e4831edd59fe28f744857e4baa10eca43c8015a0a7b8696276625e062b4699fa117905c27d2124521be0c3c
SSDEEP 49152:aSuZQIY0Be2KRRVtOnks6NMHqyYPKEnSG:E5dKTi61yYPKES
TLSH
T1DAC5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9f9040f401eaa8cdcafcf752061916313df9d9f9092c339fa1bbe4504fc718c1
MD5 361d0b520efb041314388a60f48631c7
SHA1 a57c04cb1807a3242f94323633e469e90085649f
SHA512 e5c5c10301d4cd31255117ff4846bf592cff1e8fe12b28e869e7f29dbc5b190df002f1c35ea50634d573cbe5a73c7b717aa66b6180f00c189e351c8498f4fbad
SSDEEP 49152:2htSn8EApI0figngiDn0AP5wbYPKEnSG:XX2iyphkYPKES
TLSH
T11795BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 78916428f3daa2f7f915ba6660982becb9240940d21e1f2099033b9a1ae044f1
MD5 60007d76b69ec7ff3c372ba0e7c76f0d
SHA1 ce7182543d9b6a1ba41c1dcaa37da807a392f066
SHA512 6af0827599efeab8183078ce1fa00e4eb39109c4bcf22e4463fdd40a2594aed506464708f356421cc7432f048c6bb8f8151e0a3b96138372c5fed9f8ac1d1af5
SSDEEP 12288:rx45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk1:r+Yz7KEMdX6keYnAcerg
TLSH
T1B06523048A5B8AD2F84A467BFBF14540C53A6ECB3B8C83A5DE4DF50293FE722450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 d540bc2eef335d4e67357f2422f457b25cc76cb93bc07ab3cf8cb973c8bb3fc0
MD5 5528da8ffe7e255da1cd4ea62474d264
SHA1 54507dde3213f0a59a672a602afe8850742ad96d
SHA512 37b959c895f096194a9d2e7aa4ba1cff25be45c9ec4255798d024ec4fe13a93f98576e3e642ca5c6d322ded6875e6f5bac81413b3a20042ffb6445633f98cc44
SSDEEP 12288:oW45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk1:olYz7KEMdX6keYnAcerg
TLSH
T15D652304891B8AD2F84A467BFBB14540C93A6ECB3B8C93A5DD4DF50293FE7324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 1ac80f19706b5cf39aa9783c6856596098d529550c01ba1650973dd98c1b857b
MD5 8fa3271514a1549fe79af407e6de8efc
SHA1 d17dc2b2101e5558fc0252df93511b38a2245234
SHA512 65d6fa9c502b36ee485a467b62f36190a47855572b1cb2faeca9fcb58f0337e20dae6c25757b61c5ab52cd565ba173e7f28f093c2710e9080d276db5fb591eb2
SSDEEP 12288:cU45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk1:cXYz7KEMdX6keYnAcerg
TLSH
T1A96523048A1B8AD2F84A467BFBB14540C93A6ECB3B8C93A5DD4DF50293FE72245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 f37cf9e9eb017486555c2d02c0539541959b4f4fa025b91a55e918b893287500
MD5 849d3199e71e71b4e210d7e98cf93d31
SHA1 93a3716815f4aa4a8ddbfc2bd2570f0a1151a669
SHA512 92bd225d16b5f6a1efcdc559f4c71d883cc343983d6cb5e2a289aaecd6853cef8f8815bdcc59f1782a6e34a25443436203afc3ee5cdf6797908c1ef50b26c4b1
SSDEEP 12288:6Vv45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:lYz7KEMdX6keYnAcern
TLSH
T1307523045B5B45C2F85BC27BFEB18500D6777CC63B2893EFCE08A5424BBA3615924B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 8b41873b1c46827301512b60c9b7f587f8364b58070a835ff7012173e518a76e
MD5 8d887aa7b12ddc69ea83ce3d56f7f64b
SHA1 84dac1332dd93618cf4d272769b9d331ec9f6290
SHA512 e90d6f398ff48e8586a86ad0ffed6af75816133a59347dffca52d3773dc47f338d8ac5fb4e537544fdd66c4cbf055aee279024da137431b1cf79be4319d8c123
SSDEEP 12288:SX45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkr:SoYz7KEMdX6keYnAcerW
TLSH
T1DD652304891B8AD2F84A467BFBB14540C93A6ECB3B8C93A6DD4DF50293FE72245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 f48cca286350ce8242d32849bb1ec78756c71ca3bfa609a85ec9a2bc02b5d0eb
MD5 f750a52510e9bea448bed4369ac5e8d3
SHA1 ec6e9acde002582672e53b09bd07de971b646ad1
SHA512 b636db93e1c25c4db2868cd3cc18aefb0a8cd0b41757dcd5a1da144bf8611827a7fa83c5216783616eb96dbb8141e871436e607b5f87813cf8e7d35cbfab7bd4
SSDEEP 12288:E645Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkr:EBYz7KEMdX6keYnAcerW
TLSH
T18B6523048A1B8AD2F84A467BFBB14540C53A6ECB3B8C93A6DD4DF50293FE732450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 c94d62f2f3addc4198a705e375caa14f66a45f985a4e7bc98fa445a9d16fc6eb
MD5 526554ff62f34312df6cab803fd2f98a
SHA1 ca50efb8fd6f0197ab644677ea9ae7629ea7b7c8
SHA512 92f6710ab8fbc0c05230655cd478cb66a2e7969b70fda8bb0e0d3c77b77b55bbd28f5bd65231b61df9f946791088efed6c74e392aa39dd4f3465b0ff99f13cb4
SSDEEP 12288:he45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkD:htYz7KEMdX6keYnAcer+
TLSH
T14C6523048D1B8AD2F84A427BFBB04540C53A6ECB3B8C93A5DD4DF54293FE63245057AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 e3978281426fa62d121a967c4d0978be729aa9e2326bc20402d94c09383ebe26
MD5 311ca22979e5585f6ff7e87d9ed9b5b7
SHA1 db7db1a385cde6547a6d68d90cc1959773e85419
SHA512 475b02df6d3dbb4a1041dc4ab1e48ec4c794077416525b88407525682ffdaf48227c8db9c66e93a6fa4e0d3ff3585316e0916ff85a2f3fd2788cd19293db9c99
SSDEEP 12288:jiZwbHzzFEoS2cPvy245Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkv:OZMTzFVSOFYz7KEMdX6keYnAcerO
TLSH
T1BF850194B3500CF0EC67823ECD658906D6B27C5A1B60C65F07A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 fedd021bd519458051823bb1aea7dd9727ef99d4fa068b52af75e0d4ceb04c9d
MD5 4fff0c046077545b55030f69904167e2
SHA1 7e628ad9e86f89f0668eefd2ebef2921fbb2a586
SHA512 fe359431464776b60573d51c67fb0dd42ebd3fe4fa51b3156f099de57a21eb5baaee2f7d1410b2e2b36adc3e67866f84f3497e051cc29cd0969be2eea9c724db
SSDEEP 12288:Qd45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkd:QiYz7KEMdX6keYnAcers
TLSH
T18A6523048A1B8AD2F84A467BFBF14540C93A6ECB3B8C93E5DD4DF50293BE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 d5d2c43738ad94e32533fd40ea9ce288d29309275146eefb4523cb675a6e7691
MD5 b9c6b52cbfef673368bd8cdcc570aa2c
SHA1 347743a4ec07a9f5c30ee0f167f8d5bf63b31339
SHA512 e55a7043faf640caf0fd3306c42248311ea0f1080e816461dd62b6883a7e8554d51605ccee46bd606ace08d0bf39b00de3825a06eaaf72e484a6506421a0d6cc
SSDEEP 12288:Ep45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkd:E2Yz7KEMdX6keYnAcers
TLSH
T12B652304895B8AD2F80A427BFBE14540C93A6ECB3B8C93A5DD4DF54293FE73245057AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 6de90ce50bfa77c11a7ad3fe2d772d77450c3dae49e1061f9b17ebf7e45fcf69
MD5 0a5067b45a9e24c1c8fbc3d49098a840
SHA1 bf3f396165a343effa58ca7bdd47669538e62340
SHA512 6255e5977cfcc9411c2e45bb12161f2208d877c5de131d8bde2ad7a504b3b47f753c812fd10a10a113d5e719ebdb66f2ffb7fc5d787ac722c834b1ca09eaff66
SSDEEP 12288:9yPz5L8y45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkp:0zy5Yz7KEMdX6keYnAcerg
TLSH
T13875120767A630F5E0278239D9A20A01F77278761B248BAF579447732F7B3A15D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 7ca76db93db71e83e3ce93286933223ef36d2d5d89947dd3e6cde20ebd645c07
MD5 8e859505b689a4c71e30216a20859f2c
SHA1 8f609cd7e4a327dd1c05637ac355daabb574e203
SHA512 47e98b01d7476cc9294a1cc59d89a245610e26a0b6deb0b6a6a41506248b3a2147802d4775d0514916d0b6f29b2934d7ea31e3b4244151fe2073cf580449c2bc
SSDEEP 12288:Gd45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkh:GiYz7KEMdX6keYnAcerg
TLSH
T125652308891B8AD2F84A467BFBB14540C93A6ECB3B8C93E5DD4DF50293BE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 07a84cf4ba0be3c3ac6e1e262470ecf6a2c450ba4639cd0fada790bf4042bedc
MD5 39bcef4b0cee058f35fa229c80c8b07b
SHA1 aa873ade3eedc85133063728218180ea7d25caec
SHA512 53fe37edf5614611a93ff1806ca697356f2e3d48782036b142d581d4498b29d2cfe97a2a2722da20f320761747f9a0a7f3396151a0bab33aa2b0ab606df95942
SSDEEP 12288:4d45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkh:4iYz7KEMdX6keYnAcerg
TLSH
T106652308891B8AD2F84A467BFBA14540C93A6ECB3B8C93E5DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 da6cbc0c6b6326aca645305855f15808ab53f612de461af566411db5e58d61da
MD5 05ea3f4ed9a82a04cf3af3cd905f6e63
SHA1 cf0684d95dc4a06ff5c315b97f9047fd8173047b
SHA512 f1edf90c711432536edb7aae1434be10530beb0d0d0f2677341ab53eb139a51867aa34a6f76e5ef751b9825af849dbb6c522786f8aa584f1b938d221abc461ce
SSDEEP 12288:WyPz5L8y45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk6:rzy5Yz7KEMdX6keYnAcerL
TLSH
T12C75120767A630F5E0278239D9A20A01F77278761B248BAF579447732F7B3A15D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f494d51e7ba950c91147c2232c5893f59a46efee358642845bced7c077db4154
MD5 f6eae02c0749782fc773bad9b7111f78
SHA1 01033346865f580d05a6f0f848f824f56934e904
SHA512 02e5b5da6b5ed7fed6165cdf5f54e6cadfa2ec39f5cb32c52944d4c5c26320fd12d536af150206ede7de0e8dff803dd05e68c47cbbd3c8d9c33c45962fba0e88
SSDEEP 12288:8Cd9ZWYoaLHF3z0z04PDvhk45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkC:lTIaLl3z0zDnYz7KEMdX6keYnAcerz
TLSH
T16A850194B3501CF4EC67823ECD658906D6B27C5A0B70C65F07A836675F373A11C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 4d43f5c37d42e45a073eeeef3513c192e2b9c1f27fb0039662d3e57bc955776e
MD5 560c25ae06233a46c0f4fb35d81c2977
SHA1 2a95b8a856134819c2881750565f5bddb145ac78
SHA512 fef0b60989d1c4fb18e38c7504e39af914b86e9eede4010372880590c16084aa2f3a9fe699c1fb7555d5f663c9f9dfec301a6916f79ea80e52ca6554fa6eb6a8
SSDEEP 12288:Ei4e7wRdTfgwCHKy7GLbbdIvr45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkg:E35d9CHKy7GZTYz7KEMdX6keYnAcerN
TLSH
T1C595CF90F3E414E4F0B78A35DD764511DAB67C9A1B21DA8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 652986d9d50dfbf217162a75f11da41b60cac537c8fab5264d2d4cdcc30ebc38
MD5 d30db8b24a5342952bfd7c50d4233e7e
SHA1 949955b17eed54f32d65f8499fc96589c13c904d
SHA512 fbbff584725c5305163b2cd99ce48b3c028b8312e9d3c76283bee677bda0916c9cf25f32f20d7a0fbc6b9e27049687d3a7aaf7780c9b991581af7dbc0cf07c27
SSDEEP 12288:S045Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRke:S3Yz7KEMdX6keYnAcerr
TLSH
T1836523048D1B8AC2F84A467BFBB54540C93A6DCB3B8C93A6DD4DF50293FE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 7981d465c3f727120b5793e258d261b511ee42839fcd6453afdead18fdc198bb
MD5 990072789af82af0ee89a5688c5c7c9c
SHA1 eae623f86b45dcc7910ff25d02b16e047a16fcf7
SHA512 f025b366e72cab2acb15086b49642c71ae6249583950266e6dad9aaed34957e18cd3b101ba7e72ee5af28ad3ac9d1421049014c3f20aaebe4d76683a766577b6
SSDEEP 12288:azsft45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkT:lyYz7KEMdX6keYnAcerK
TLSH
T1CA750109C29802E4D06E527ADB964A40F3337C6657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 85e5e997260f193b4f1ba1bfd634efed9afe64b56f47d4d387076f0e1d04a412
MD5 856dbea93df412e61d4c2e242d0bc427
SHA1 112a842f56a4413ef0e201d10c3d6f9de69c8a79
SHA512 1c8a0f03c81c8d1df844d28741e48ca465873666fc3ab0c71d481aeb760986f2f5d8f3b2ee13e752211026d8e040ca5a17418f5f59a602d5848fa8eb824b26fd
SSDEEP 12288:Em45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkl:E1Yz7KEMdX6keYnAcerU
TLSH
T1697523048B5E89C2F86E4677BAB58520853E7DCA2F48C2D3E80CB642937E6E14D3575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 94cea6c1a8cd6b5fc8ce3c93e16655034ac031a25fee70ed395e0e2c8750202c
MD5 554472edf47beb62af9d4cdb9a49e1da
SHA1 26dee63e4d75579ccb1a6017decfcc154a6e487d
SHA512 5036319f200d23bd0f48eff3950ef7d6fab857dddc895038722e425c2a21cb3873a3a2e597867e92c2f729e79d7247e46c91c644c51c5f595207f8b9b785967d
SSDEEP 24576:58RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCjYz7KEMdX6keYnAcer0:mRZwQCyiHiQEaaPnMYYPKEnSG
TLSH
T10185AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27D1F2BEF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 cb9a2fe5a56a63f452a996040a7809f744e08500739d5db72802a136af3ebda9
MD5 868369dec8bac5db39036a9cfb1b1d97
SHA1 a9ffe483697bf7c2e7e2a01c97ee219475e50a67
SHA512 769296db57af777076978e625edd14d68ab2bc92d6ec4e7edd0c89232c4d157f5210bb1dc09e0849e3c489b8e3b9977f3a6569c59df5a526c226d9f96b3f9d65
SSDEEP 12288:pbxA1U7Kq45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkX:pbxA1UGxYz7KEMdX6keYnAcerG
TLSH
T17C75122E56AD18E1F47A923EEAE18101C3327C56272493EF5484C27A4F3BEE55C35F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4ddc1908389d4b21409dd6ab81167e4b21fbf7ee2ea379ecffb9c5f85279df90
MD5 28b8eb904af87ec6de7db6ab83f011e5
SHA1 26f8143a79586d525702ada38637a884ba0e39f0
SHA512 428aa1a245de056e4f06963b55229d26b10180e7f2879449365cf3f80321b183a55bfc8211453b3325eb950920c97b2ade6d4279cd689059db092046d679c4f9
SSDEEP 24576:RjsmP0yHaqrVqHra44KDzMsrnqYz7KEMdX6keYnAcerf:RjRP0yHfVqzlAsrnqYPKEnSG
TLSH
T1C945AF2EF2B910F9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 2cec182213bd14cd95ec0077b8edef9e0bde26126f637ee898024d9ad1ecb698
MD5 24f24f937f4d1881aea4a49c6fa9ac5d
SHA1 50872f0a60170a4a41fc4dc49d62b947f9ed911f
SHA512 f8d605714981968b37bdb8e0067ed3415cdc053cfcfcb3b35d115616ac3d8c58f1c66e3a7c0c8391212928962fb82a6ab4f6b1741f1c376a083b4985d406b13d
SSDEEP 12288:2g45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk2:2bYz7KEMdX6keYnAcern
TLSH
T1EE7523088A0B8AC2F85A467BFBA54500853A7EC73B5C53E3D84CF54293BE6B3453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 39cc860c9aa15ede15afa7f2e292797ba6b33b2173b0985ef1a34f21e1952634
MD5 096653e07b0606a61af9271aea63f131
SHA1 f1604db6a3521df9d30395ce8fe07b012a57875c
SHA512 056722d5ffc56f2b8a2f09b7145a07020c17327e4d499ad2aca03c59edcf9f9dad2bb8b7f6a74bcf994c334624a00ac3cf7e74a2d383665a2559f47f9ff13d9b
SSDEEP 12288:zObMA4LWO+vAYFTK45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkE:cMLBUTRYz7KEMdX6keYnAcerl
TLSH
T141950114E79500F5E86B813DC9B28A12D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 352228c4781f146910e0fc3c8ba7305e88159e9b101e40050bf785033863bac2
MD5 53173898d8680e57c9e72423fc834362
SHA1 ce84db2fe138299da1b9761a63bf59438a185376
SHA512 aaf8aae945a3442fb4b20e3952193c46c90ee4caad92615b5d15dcc03ba71d6dc004c598a6eb7e6d69a446e50e45d7f966fdf0bade59c1ffc4ddd5563109f164
SSDEEP 12288:w70VmKIYNvUyBpr45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkY:tGYNHGYz7KEMdX6keYnAcerh
TLSH
T16B85F11E56AD0CE1E57B917ECAC28205F2737896171193DF05A0C27A1F27EE9BC3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 43a1c40aaa23dab720ca50805d8984bccbda344839af9c2fa806bb5b22b7b356
MD5 66c4c5682a20c3e87c881beb85eb23cf
SHA1 80e7607b4e2eb52ea04e3677eba895ad1d31d098
SHA512 7e220e13e9d084944228c4930dcc0649cbb5fd54616225ef711587f2fbf69b14dad1cd0c17763087d567f8e7a7054007f27bdb8ff6bad978eab5bbd0f34e6fa8
SSDEEP 24576:2nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK0:2nXoJJYH84VVS6AmEcJas+cHBjSSKHPW
TLSH
T11265BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6859ae408929b51e646e76ff508572a7d9295619ad24aa4647f8f837705751b0
MD5 ed1624153ba52c86a6c4a2c251a2bff8
SHA1 d0e40f669136ce79548dccc2c06168a1ccb5b76e
SHA512 dbf8e4e7de3b043ccc4836b368acbf873d959915930daa7a2d17cc60e28ee770f4960ab04e3f817fe3316b9d4d6fd2a34adecd3ded17d55cbc8f10bddec691a9
SSDEEP 24576:av7Xbxd9Tuycf8M/TYlSuxwr2PCsYz7KEMdX6keYnAcerW:aDLL9TuJ0M/TYW2P7YPKEnSG
TLSH
T1F6858D5EA2EC42D4E47BD6BD85B79046FAB2B895273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 d119fd271b67d53a1237c3c5e1e54e090cefa1b7187f9f86259af294e93cb0ba
MD5 d15df86e8d67f497c9f92af4365305a0
SHA1 c7727f5182a500d97b7516d1da2d273f2d5f6ac2
SHA512 c579c40ac3d605e9164f7c48ab1da5e1e79de8e412857430414c6f6f4e6b1e270f108609238aef05a42ff0bad70d0aff7f5b80873b5ac990e013d5965232a31f
SSDEEP 24576:oegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wRYz7KEMdX6keYnAcer/:ongOJOmPOHhRYPKEnSG
TLSH
T14855CF3FA7BC15D5E03EC17ECA928916F6B1782613255ACF0560827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 71b85d34ee61d64a57124752d34243140a39063390ac79f6cbf80cb86784b815
MD5 eb537264854b231351fe12aaa46233d5
SHA1 cd0701f19207f27cbbba5b5d0cdcae04ff766e67
SHA512 9b5cf12f81132a7dc9ceb0d91f659032c8b16cc41a6495d6d401e72dcd2d6181bcef652c01ad590b81f6ad01b746bb6e2a638e5fd79ed115012503bd58e86670
SSDEEP 24576:rLJnJiTk3R3waE4JrO7Yz7KEMdX6keYnAcerB:rLJnJK8R304l6YPKEnSG
TLSH
T19185E02CD2A910E4E4B7C2B4825A1756FF32346D2F2569CB59B4D5313F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 36211b001f205995167b2cfee650fae9b87d52b89a28a62779d9ec999a303986
MD5 e4fb43f7d7d1b7d9a01ef7a375b4074a
SHA1 912443c366e448f1e4ee577d589f385691676f79
SHA512 0646e41b27a411e6e4bff943e107da6f4307da0fe3ef9fddf9e8b0faba30922624c58e85c028695cbbbdbe56a7ad0ff98600fdcd860cdaa2d5d15775ac30dfc6
SSDEEP 24576:SA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pJYz7KEMdX6keYnAcer/:t9GqCzDScAZmlvTcFg8Ph6PYPKEnSG
TLSH
T1DA955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 560c34669e4bb0118eb6f0bb4bc31a58515a8e25f8e46203d04d1524c6d8a0fa
MD5 679d9aacce47f79d6b8fd8b7ea30081b
SHA1 5ee868695b47ffd95b8f7f3184195c855386c974
SHA512 49c860293f299a1175f5da91734e6e8e45c436f28d4908e6f660f73afa09ab37972b34778939fee45f94e40918aa813b2d2730d37cddfdc3b5d67df1cb7777df
SSDEEP 12288:KlYJeXm5nkEUuEe45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkZ:KlYJeXm5jUuEtYz7KEMdX6keYnAcers
TLSH
T18975120C669D70E1F02E817EEAA14900D372F4A6274553FF85D4D2768F6BAE21E39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 527787a9f3ead550ebd3eaa1ed24a2c6590d48abe0d4d053ed8365f8a50f1ba4
MD5 8777ecfa78bac2bf2c0da4c6607ed21b
SHA1 f86aada546bc84e67b06de39684efd24349d4119
SHA512 82d005aad30008be5c717d47de3b012e1bf732989a5aa2cbc72123ab61f90fdaf9ab20ba859bce323fdca72b217b2199f986c1a3619d494029d286714bab15ef
SSDEEP 12288:1Cu6kyl45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkX:1HtyKYz7KEMdX6keYnAcerm
TLSH
T1A5751204579555D1F8BA0639EEB28150CE36BC612F1483EF94C0F62F6F7A7E1A830B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 5fc2de849a77da7ef610f2635cc78f13b5cc7f7ada407dcea476aa19a2337c92
MD5 112965354478ed792c761c184352d8d5
SHA1 ce0e25b3f4eb2ddfdaedfdeb4b9a5c1a2466af76
SHA512 a04f3b77b50d15cef05a86b624457042913094c118238c7321c27d6f10b4488d64e44f62c0133173b492c78f691e1296f3cba7403be1bf722c784bea908acda4
SSDEEP 12288:GPK45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkF:CRYz7KEMdX6keYnAcerc
TLSH
T1A675230C461B59D2F80A467BFAB14540C53A7ED63B5852FB98CCF562C7BE2A24431F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d283ea3e38ecf626ad27de996dd30c0972d2f75e9198e1def91294bfc4812a19
MD5 2562ed3f1b012dc75e47c423fa4bd4ed
SHA1 a50bbb1e409319becfe5bf36e8224a67cfb11694
SHA512 1d678aae258fe86090c4b0ee55da6e2d1d69d60f793d3e07536721292feb02f4436f9e684d2c6535a02cae8bde5836b0be7f97bd0c50f712acaa06fbeee2ff7e
SSDEEP 24576:NC+TyQIu93VAumZr7jmQYz7KEMdX6keYnAcery:N/TfIq+YQYPKEnSG
TLSH
T191558D1DA7E91DCAE176C675C8A34493E633B872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 3edb32612c1748522cfd608d316fc22b8cf46323bc10bdee3b0e122814cc16dd
MD5 ae89de1aa9ff97b4650c98868ffc535e
SHA1 45cd37b41e0253b735f71740a609d2a4b61d0440
SHA512 e1e0a9ec4899150db7e20c0611d55c01e6fe344ee229ee0a8f1c8cd08e82babe937807c2e110c42433a381c6cb6327b833b14599863905c6fce9837ce883a10f
SSDEEP 12288:WcyrWOstaa3kcse45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkS:PLQikZtYz7KEMdX6keYnAcerH
TLSH
T13A85F10EB7AF00A1E4ABC23DC9954101F6737475171263DF4690C77A4BAB6EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d2577c20343b8b8aa0b4c23b710f2ed35abf121f8447008986c59c4dff2fd9d8
MD5 cd883df02057384ca6740b9aba564746
SHA1 74aee3f81100de4f4eec48927c2789fd39829e45
SHA512 c8a71a131106a8651b848e4ee23fbf431e6c80a9731f9f61b499eae755e1383aca59e007f5548e430ddbdeddf7f08c8ccc38af3672dc793d8f91b3fdf4dff861
SSDEEP 49152:EpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPKYPKEnSG:FpC7b4+80GTk3YPKES
TLSH
T143A57D3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6605d4fbb111a7297f985e4466e6d3725d7a10fe56b82bb15ac1ab19bef7e53c
MD5 bc8213937802ab1f59d2bbf3dbd62978
SHA1 e099a238e7b1e44792c5e50978b971922b84b28b
SHA512 b9f139eb0034e01454ce62b67285a69fbdcc5a03d328c9b1168c063851a663dc7c8ec4e2f96038845878823fd5f4a5797e9cc539663fae16959eadefc44c4e52
SSDEEP 24576:MSAwJPE1IDAo+4Kt+l44135UQiYz7KEMdX6keYnAcerJ:MqPCIo4Kol4/QiYPKEnSG
TLSH
T19A55AF29A7F946E5E17AC7B5D663C601FB727822133163CF9290813E0F16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-47-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1100-53-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1100-245-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1100-55-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1440-79-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1440-81-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1440-76-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1440-83-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1440-70-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1588-340-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/1588-434-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/1632-329-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/1632-268-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/1632-260-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1632-266-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1740-335-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1740-287-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1964-336-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1964-433-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2068-326-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2068-429-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2252-427-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2252-306-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2252-314-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2252-312-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2412-247-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2412-85-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2412-91-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2412-93-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2832-12-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2832-120-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3724-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3724-246-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3724-58-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3724-64-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3852-428-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3852-319-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/4228-40-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4228-45-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4228-0-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4228-10-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/4228-6-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4340-302-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4340-300-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4340-426-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4504-450-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-435-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-470-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-454-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-456-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-457-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-458-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-459-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-460-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-461-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-462-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-463-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-464-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-465-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-466-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-467-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-468-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-469-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-455-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-443-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-446-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-448-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-449-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-447-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-445-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-444-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-442-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-441-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-438-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-440-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-439-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-437-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4504-436-0x0000020EEC640000-0x0000020EEC650000-memory.dmp

Download

memory/4512-25-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4512-31-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4512-32-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4512-244-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4652-431-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4652-330-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4912-67-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4912-43-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4916-430-0x0000000000EB0000-0x0000000000EFA000-memory.dmp

Download

memory/4916-271-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/4916-275-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/4916-334-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/4916-280-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5172-389-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5172-352-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5172-451-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5172-452-0x000000000B9E0000-0x000000000B9E8000-memory.dmp

Download

memory/5172-421-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5172-350-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5172-405-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5172-344-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5196-325-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5196-256-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5304-423-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/5304-292-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/5560-35-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5560-39-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/5560-23-0x0000000140000000-0x0000000140C7D000-memory.dmp

Download

memory/5560-14-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5560-21-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5880-290-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5880-339-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5880-432-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5936-323-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5936-321-0x0000000140000000-0x00000001401AD000-memory.dmp

Download