a08624c0c91b20b08f75f7b2f27180224b9218d586b835a80942ddab9d270d12

Analysis

max time kernel
134s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_8911f65f9511dd90993de4bc7bec9ca0_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260701-ejwbbsdy9l
SHA256 a08624c0c91b20b08f75f7b2f27180224b9218d586b835a80942ddab9d270d12
MD5 8911f65f9511dd90993de4bc7bec9ca0
SHA1 e0fde9c7012a73b2f654c10461dbc6ad92e2d33b
SHA512 0d79f13cd09293d2d805cb0116ad1217115df1738e44242766030caa8bbe764de7f7acfbe95c453a27f391dc0b103bd88b62b625d4d4517f0f60e211951acb91
SSDEEP 49152:s+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755h2:R/PvOBjcXvvOOc5jD527BWG
TLSH
T18E165A1E735885E9D5A6D1BD8A42C506E271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 10 IoCs

pid	Process
3416	elevation_service.exe
3464	maintenanceservice.exe
1516	OSE.EXE
5516	PerceptionSimulationService.exe
6032	perfhost.exe
3240	ReFsDedupSvc.exe
2776	SensorDataService.exe
2848	ssh-agent.exe
3428	AgentService.exe
2108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_8911f65f9511dd90993de4bc7bec9ca0_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_8911f65f9511dd90993de4bc7bec9ca0_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-30_8911f65f9511dd90993de4bc7bec9ca0_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_8911f65f9511dd90993de4bc7bec9ca0_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b14433ee4a0960ed.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_8911f65f9511dd90993de4bc7bec9ca0_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095d8ad370e09dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076aab7370e09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000084766f70d09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b9176f50d09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e90090f60d09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a55355f60d09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000643de6f60d09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b27770f50d09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{77B82D33-2996-4167-94C9-2EC3EC995366}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\NotificationData	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{342A3838-F12E-49AC-BE8F-A3358EBD2A81}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
108	explorer.exe
108	explorer.exe
1516	OSE.EXE
1516	OSE.EXE
1516	OSE.EXE
1516	OSE.EXE
1516	OSE.EXE
1516	OSE.EXE
1516	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5812	2026-06-30_8911f65f9511dd90993de4bc7bec9ca0_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3416	elevation_service.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3240	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3428	AgentService.exe
Token: 33	2108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2108	SearchIndexer.exe
Token: SeDebugPrivilege	3416	elevation_service.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeShutdownPrivilege	108	explorer.exe
Token: SeCreatePagefilePrivilege	108	explorer.exe
Token: SeDebugPrivilege	1516	OSE.EXE

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5460	sihost.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe
108	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5716	StartMenuExperienceHost.exe
4980	SearchHost.exe
108	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 464	2108	SearchIndexer.exe	101
PID 2108 wrote to memory of 4320	2108	SearchIndexer.exe	102
PID 2108 wrote to memory of 3512	2108	SearchIndexer.exe	103
PID 2108 wrote to memory of 6020	2108	SearchIndexer.exe	104
PID 5460 wrote to memory of 108	5460	sihost.exe	109
PID 2108 wrote to memory of 4856	2108	SearchIndexer.exe	116
PID 2108 wrote to memory of 2032	2108	SearchIndexer.exe	117
PID 2108 wrote to memory of 3228	2108	SearchIndexer.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-30_8911f65f9511dd90993de4bc7bec9ca0_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_8911f65f9511dd90993de4bc7bec9ca0_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5516

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6032

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2776

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3228

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:108

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4980

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 456b1f1893ce5c5dc874967579d4c02057fa8ce194badd1647e015eb9bbde80d
MD5 f7e8469d442347231a1f17fdcf82c206
SHA1 bf469d902cd069660bee77c11ed4036ce5e7513e
SHA512 97bc373694201b3739800b30b9ec5c567633fb1efe8386cce31e6acccefb874962c22a13d5c2c980dd06ec760f81e8edefee9732adfea17acccf263536050d7c
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJDmg27RnWGj:63q6HjBOD527BWG
TLSH
T13CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 27a935c686958ed0bd8b792d4843b5f8758406bc7cd4d9b387d45b77021cafad
MD5 046d04107ef32c9264ede40107432ab7
SHA1 bdef14a64fda463b2179e441cda85f59f910333c
SHA512 52c28720722efbadaa67c29bd3412c17d9d833cfd4ed7a621f632abf364e9eefdf53d6b68e578cef4a2aeaab49f0bb748e830bec1bead28030326cd7a1bd2efc
SSDEEP 24576:NXYfDtczA2sqjnhMgeiCl7G0nehbGZpbD:YtcrDmg27RnWGj
TLSH
T15685F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c5f364279d4a6a360b3bfeda2759060f11e4fef093f5036797e6423a974f8a36
MD5 1c57ca33b4e6820b5633092480ff49c6
SHA1 a15718593fa3f2ba9fd5a3a95f9f7d6ab651c7d6
SHA512 6104e086c86a4df3d2ec81142140d878fce2bf31eb68d21e187beb9d1b4708b0607e310f51637747de3bf6811be87aa3abd31566c98c2f4c13003901700e868c
SSDEEP 24576:V0Le5ji0hmxXrMdsqjnhMgeiCl7G0nehbGZpbD:VPji0A54Dmg27RnWGj
TLSH
T1E4A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c5b7b513999d6fd6468c59ed1b206db6b3a44378bdb44a1e0fdbd21fa50da6d9
MD5 63346bef46197307378879a2c7e2b215
SHA1 b2257cdb5566e91e91c938a2daec4aa8acf150d2
SHA512 789ac06b76862487380f35463317d18f9d11f396e126afd1d29c2f77c6ea6b920fe7d746b92c0e07ac1c2a60f4a5793bffc12999cf8c8b8a29c51702d9cd49f7
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuHsqjnhMgeiCl7G0nehbGZpbD:g/ezSC6vUzPvxHjykDmg27RnWGj
TLSH
T1CD755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 56113170b6240aa62b040efe48396c7db848cd663fc3e7d2ba8fd83751bd6d8e
MD5 281572d64e43490ff9df028161054526
SHA1 098156cfb44c430602e86ea2a24a2d614f1525bd
SHA512 964fc15b8fdc9f5078c6df6dd888243d8825f305adb0dc5b2bb91c899afd9b185d73953a29be5b4a825317dda582000f67727f45f498e5438212462782855fa5
SSDEEP 24576:pVbqPb88hv/l+6asqjnhMgeiCl7G0nehbGZpbD:pVO88hXl+NDmg27RnWGj
TLSH
T179559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 fb7bbb15404ef420a7e446e7face9555c2ccbad1aab17a8a30492cba108c52ea
MD5 f94efc8126a4ca7aaf6216107542e885
SHA1 4b026ab9c3b41a8a288ca5fce90b21dea5f1b119
SHA512 523b12dbf33594f668049da216cefe7dfb91127ee1fc82ff4fbaa43ba4ed9d49f66f4aa19a03b62efb56106638d0eba928523b57f04b06d344339b275d4657e3
SSDEEP 12288:B3hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:B3hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1247523BF864C50CAEB7608B5C3E9F11EAC177E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 2e44ed370f6090d1140e51ae5929a138a13218fe83961e031412fe98b58300b6
MD5 f95100481cdd9cd3d82e7413a50ecdf3
SHA1 4fece2a0444364b4fe761b5b638e6e5974998a30
SHA512 b2332c38fb5b77acafe55e4d5fc91d88f54caa43ab6086c28ad29eb84e26ab11c7f6abecedd50fe7b4c2113b2c3bd7923b646b1868e9486513ae4f6df061fdac
SSDEEP 12288:eeBNUbTVO86UiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:eJIUisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C185CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6a5636d48eeb2d08e91dd0dec4960bf7f4437542f45473679dfa4a466484f281
MD5 efc1fa5b500e00bdd1f7180a8af297b9
SHA1 86b488933d4a039df63074ae58ec6fc6014441f2
SHA512 dcd06f6447165c180ff73f532ee7f938893dd8b827940376411772015b9acbf7e4cd3f6a9480ed5da743a5770c9280e3a5481a9e36937a13a6a8396f868ee6be
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:9QvGAdlCEL8c/yRNw5CLD527BWG
TLSH
T1DB266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 c7f5ca3c1241564aa3c2a9811d430a4435dfd075ca98e882cf0b8f15996b8a65
MD5 0d9f00d65b84740bfcaedd1dfad872d8
SHA1 c24689d742b04014e57ab812c58d545415cb5a23
SHA512 cde529187c02d76c251dd231cff934b3e6e153e8e2b76004d655f6629ad1d911e4b7e0f7be983ad8f554b3d98e1fbf8b07ac278e0285e53f133d719b8d3e4451
SSDEEP 12288:JAwSfxL/2Dc3xDLLmt0LDQewsAj8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:60ewsAj8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14495E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 26ba97596d6aebbb70e6d9e42e2ed3bc3b01467cc2c2709215d4e0d7c0406f05
MD5 d86a49f1845b7554b4941144e07b7253
SHA1 07609e8b61631e98ffdef4a9372fb4568aaaa0a8
SHA512 03b1c414930d46ab7fdb08e3cb0c651b7dbe746ae91dc44c83e5755eff633f53c162451e3b3470e5230603a230d50ab901795e618aec1de02af62e34602a6fdf
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHwVQBWG:8UEtQevvqc2W1cpV2EI323B
TLSH
T1DF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6fe61cd133cf70d88260132bbb1f72060a32a4320aa5bf8f5ec12106a44ed450
MD5 5e18868db0947d81257bd67a664e7fc2
SHA1 57e4f2b641bf23f62552f21d260d7b72cafbb69b
SHA512 51e726eb346c4757cdfa372a8d2d67479d0c8c2abeab4a2a84181d62b232687ae056cf266168b4ea22f6d3cef3d067a57936a268c2c232910386ef1e39b1e211
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zIDmg27RnWGj:UoqtVjnmnD527BWG
TLSH
T1DFD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5ea1e41a4a799c140eb3d7947cf304c403942ca35f0763086a38c4c2fe932a40
MD5 6b5fda8c5af3f9f82ab4e31880580b07
SHA1 0c61841659b4808def2580b585d568364c8cde1c
SHA512 4e8bddd48daf7246717fa2b34f3289f8f2983390d8300ee10f27d527c1c1b167938d860ca13c66451716220c77d454b2f229723d1591ff5750ef7c7c25af3e1f
SSDEEP 24576:QAhGLJIFoiwtA5l7S53DsqjnhMgeiCl7G0nehbGZpbD:QAMyFoiq5XDmg27RnWGj
TLSH
T16D359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ad5087908530ad5530d83a3eca6ab06d2d668bc1730e83359aa3dfe88ecc9f0d
MD5 e6358948b1c0cb9eaa47fdd0043c6a02
SHA1 69e41a482f053222c15d26281357d22b754dc1f3
SHA512 059e9c65edd86367a50df1788e12e912340bcb8fe453d08d5fc30e31f3d2617aa28dccb185eab43fde1ae3074fd8cb31b4657885a7d870c7435ad3df1fd76e5a
SSDEEP 12288:Fmw5HEjsChNCBFgl0WDm+CnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:gwubOWYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B685F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 e077de3b7597b4692c409162efe2091c1f08c25bf11c26ca4172ea443b69b621
MD5 d114bad0b3f74581b601b3d4cedd927d
SHA1 d1a7211daacb00a6562119e9fd1a58981b5de1f9
SHA512 5a0f562b2e519fc64eb24c376c2606446eab69a2e877b3e0f29a5830e879dff1702292fdaa69fd4337fa8976a88c5461b8d4edc6e37c3ee16bcdd09f8f0cda05
SSDEEP 12288:ACZ1IysXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dZuFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1257512AA239820FAE163417CC5E5D609E7337C63673043CF16625AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4ef2bb7290be74af2071887ce30bf7b8a59044f0b9a3a87510cd5d221a182171
MD5 f7c2e6384dc7b19810d4aa8d8102bb94
SHA1 eb50e9fa50481141926f28e6ff78f968c6bf994f
SHA512 ad3a12d2e5d2d10f790a56158d95cd035142dbc100df9edac21ebb8f8ec99aa3b220783b6ed81b30c594cacdb1dc67040cf23642e20f31fe3709e9cd1fb521cb
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN3yD527BWG:LQyiKayX+PNCVQBWG
TLSH
T14C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59424e02f22ba3f5eaf82f4e54e27539ce21c65b13b8468aa715ea9c1fbf9e44
MD5 69343d927d37e9965c5a651d92e61e06
SHA1 9a0b62b770f4a781977a2b5994bb1278aab216ef
SHA512 496052f40bcfc1e16bc12042555b5d467ac22480d6eb73ac2c3d94ece36773c3cadc40de1c11cc4de141e5e66873815b057bcdc8228e73c494557c33bd4d22e7
SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN3yD527BWG:NQyiKayX+PNCVQBWG
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9967e9dd806b48ec7f8eb4d603e6444aa7fc29f13ea9ba8135c41343c979b461
MD5 87e4b22f21598152cb096c99df2b0856
SHA1 bacf67335fb0e144aab9319cc1f9c86b63f36fa5
SHA512 81dcc654476fd5fd7ba8d46980468a7d4755d1a343a2e203dac04f98e69e0179aa5e814584895c0e34dcd0fada69a1c65d159436176e59c2d9bfb09131750be6
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VsqjnhMgeiCl7Ge:/68Qg55nhheWu7PNU3/4Dmg27RnWGj
TLSH
T142B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8b0711475ab0c60abcd8bfeaaa8a7580ef591f2c4117d535f6e51a8455557414
MD5 952460eaa6181805ad7b061dbe011155
SHA1 6024e07e5993e4ddffe9de25a03fdae2633eb25d
SHA512 74ed473cd9b33fd56b2993e01f3aebc1dc7d14e6022637f5d76162b09330762ede9205e7e5f5e853e36c38d4c459b2e116330efd8ecdd120bc8341378441466e
SSDEEP 98304:fy5112gYy5azzVvL69nLKnhZ1D527BWG:SLIHmWhvVQBWG
TLSH
T1BE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8f308d3ec5f225532dc6a4d9f2c89cb98d6c7d4de9a478db9714eb7cc989ed3f
MD5 ed6b7b13943dfa6e85423dc154a4fafc
SHA1 dfb30894558a6f5c0ab918b52522a73267dd7089
SHA512 78fe6e0baa5c9fe49c2c7221491c602282bf6da124ddb37f7bcb2a4dfbcb1f6ba4f74d324fcdcc52181a3782e46fe201b13fface481399d8efdcc3190a0aecb4
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCDmg27RnWGj:/u6JmVxd2dCD527BWG
TLSH
T1C7D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7d29ffbde6d4806b65e5388a6bfe7985e6a9deac90b71dc58bb605057303eeb9
MD5 357868bfb3d05965964f5869d890ddca
SHA1 79995dd429b60f435217dfdcb831e2f6c594b553
SHA512 af41b9cfbbf03e0cd9133c0c092e462aceca694e91c71b04d50f7b62181a14aef9c2e46fa20e9348ff44b96da5dbeac09aa2c142e354ab285bdc619609c4a79c
SSDEEP 49152:G1hpsNoJpF1A6UU44CwH7R4xGDmg27RnWGj:GmifPbRnD527BWG
TLSH
T171B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4729f1ce3d70160ca73469a17d708160183c4ba9ffb6b029236dc5a2538c8cee
MD5 204d1d02542c202969ca8775c68d6223
SHA1 ef18157510444293c79a64d4c90ab434fe14e8aa
SHA512 7b542e230d9cb0948232c7fabee5530aa9003586e920fb934f065a6d8cd68a979f43cf3413fb4e49bbf42bc26e8443fa8ad925d5e69b82dab9364134ffd7a5a5
SSDEEP 49152:SSuZQIY0Be2KRRVtOnks6NMHq5Dmg27RnWGj:M5dKTi615D527BWG
TLSH
T1D4C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fc1661e01579cb9de324c76c8bc4c6cf4899161ccecda5c97681c7097f3cce91
MD5 5d0eb49a23192c22435234ccfb764766
SHA1 700422db55d3004bb3e28a14dc2bb2693449677b
SHA512 2ba8899c8d1b4e64b2ca2b08aea41c77108bafca522458e178186fcd7f80e09d14d189da55924e62f189a207b169becc1f9c24f3f2537ad7aa38de57a5b6edb6
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5w6Dmg27RnWGj:3X2iyphTD527BWG
TLSH
T10B95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 929f9f0435f0d56d1550da63b431a15abde1b8ccbfa52cb5afb421123dfb8e71
MD5 1b772ff4c3254eeb484bfc50ab85bbe0
SHA1 95447e8ce3f59d8a3aa8674e52cebf0fbe7f1cbe
SHA512 1c56146e1e28fdbc808b856157a87f72f5e9da6498c9461e00ebed1bee53e4f29370194b1e56b21ee92081dfebd299f41b9336a44089152d6d57f26e3ed2e8ef
SSDEEP 12288:CJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1467523BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A577CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 23244d45dd803378e93bac008b52bb2c7965dc06fac41dbee1edbf01d2d7ebf3
MD5 20040da2de9e4626be8fce730304695e
SHA1 bf5a2ec7bd03cc2e8feadc140eafa0a907584656
SHA512 999ca445281e4cf239b49a1793a938e5bd6473fd7f14e150d0b22185090e32dfe836e422cb9bcc43ffc30f268186d50f00624d3cbb45f6f081b572ef3b5e6bb8
SSDEEP 12288:GQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B77523BF965C41CAE52644B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 d326343d719508bf0c1aa7a7732a5d2f17f3fda117976e5b18a9f0836c959491
MD5 6546a3734c69f9205ac9452e4d6e2e0a
SHA1 330617f1251893aca271e76aa3a407bee18e4d63
SHA512 e9163399b033b8ace6dab51f24debf8e1d03e6a7eb385b8a57033829600b2c53890b6bf09ca42a2798dfddaf1ffa2e278d367dab4d44a9f7d8f050d6f0ff3c9d
SSDEEP 12288:nqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1127523BE965C41CAE52608B5C3E5F14DAC073E5BE9200483BA977CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 add22036db7b6792155a07e7a26f639fbd6506cd26eae5de4f25c5e9e8e5ae86
MD5 b81ed10f80e9ac74b5e74e76347b8e04
SHA1 802b91d090bb66f352fce2e91da84d13669394fd
SHA512 0b0e604e7c9a75cb621af96d6a2632fc8b1926e7ec8956f3ad8e5a5816b2ed508f6c7afdf007cbec691d0c0b5f562a65001ba16b9a7d8760ea1806422b4a3dac
SSDEEP 12288:BVjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A75236B675C00C6D83285B4C2F5E11DE8277D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 4fbead7f6618bc67519bcdb1c2e12120509bb7383cc612a646769e836e34a126
MD5 5e45bfc467741ad03056eea7222c8200
SHA1 e7f28ad46c5d044587b98f8034343c0767b0802c
SHA512 66ba055e36c5ec2ce0aa5c1e967906a5d95e6b9df04bda359c54a16e5c1ef1c2c99d30d7edec35799df2f041f76097241a51ea552d6bc7bad5fb1df7979ef5aa
SSDEEP 12288:wbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D7523BFA65C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 f2db9ece3382227151a300f2e0305e95306711b914b14ebbfe42323edbc91260
MD5 d11ca75585e10b9fa1610ab79712c99f
SHA1 255c58651e49afbb21a56360900ccbba45f935cb
SHA512 6e6c1f927f670b6a634d45724d2d5f9c2a4183e5f9a27b5fa2d1a929d3ab6ff93a70c6db1b90d339ade93a9202e8ee62cd6395c7d267ea6b23b4c4056385deb2
SSDEEP 12288:UEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1037523BFA65C41CAE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 40812de0cbe4c9394b4f7f4773c743067ed8ad12380d1c9fd5e4a7799b3b23cd
MD5 15c191c4105fb26ae6559c4e6208555b
SHA1 d91c734c10d088c87521fafb7e4077939c13d931
SHA512 ef7171e7567a0c0d95bad44436399dc190c50931b145848426d75a1e4bfdb63f5704ceb1fde46e41e4369deb804bbe1a22e753c6463685d7b75800ecf7c04cf4
SSDEEP 12288:toXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1677523BF965C41CAE62644B5C3E5F11DAC073E5BE92004837A67BCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 786589af9217d2a1e4c865e2c7ce719f83f229a47032b2b62150168cb89e4969
MD5 142a4a80e36a368bd734e39c106bfc20
SHA1 14e5be9e2153b11387cf765fe34ceb289aed711c
SHA512 975f1ed069749ffa6301e4ee1e7a5f1212b565a321045bf144fd0966004e2b0f72a4be9e6d1824cfc55679b2002ac3229fc31752a9dde72cd4ef236ce178abea
SSDEEP 24576:hZMzzFVSOwsqjnhMgeiCl7G0nehbGZpbD:hZMzzfQDmg27RnWGj
TLSH
T1938501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 6e86f9bfdc7a74000d7f93c9a758ec7878e63003ce874623c814595a2e58851f
MD5 9c7032300a301411886994d24c350fb2
SHA1 79cc475dcd05cbe8700d366420257f673ce9e600
SHA512 491d41b423812a61e2ca0f7352d15cade6735b8a9e0a71ec56814f56d10b1edd48332f8e927f0415f0df23efb13c240ce48e346dbf6d69d79c73411b4584df2f
SSDEEP 12288:31Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:31sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1287523BFA65C41CAE52608B5C3E5E14DAC073E5BE9200483BA5B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 a2f7be4363a06a39fe938c49c20909f2c2c7a7f33a93d3ba3b18148e329c9cf4
MD5 68be3f75f044282f4c100bce42e4cbd9
SHA1 1a9d780730733fa603dc6ca33c229a6c5ce9fde4
SHA512 c6c01ece9f1d310febd2b07258f0425e1c55cf4c806956900060cdf2bcdb132dc3e3ff8f1679d97f5501e02801a7b096844102bd6b167704df69868c07399586
SSDEEP 12288:bRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD7523BFA65C41CAE52604B5C3E5F15DAC073E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4cf04195776fe38be7476f60bdf7b252ad51eb38d2ab28e88d06665130e8df17
MD5 7826aefc4e1dd5e5baefd5a4ac512b9d
SHA1 00104a7d959907c9c44855bfa6df43d74ee1b268
SHA512 10ce186bd5e84af3b38439d58c2035a252ce66991fc05d4f813bb37a34d0d897a1f9c2dde67150bf95f9f636fb15a44dfc990042c468002f665946b292743f69
SSDEEP 12288:1yPz5L8sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:czyssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A185125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 fcf3d5d9e0479b3cbeae9f16ec81add68653d6a26c1150671958fc92a1766346
MD5 3b33ce87149e65c1944f4e644cf7edec
SHA1 f37ae9ecf7e7f3bf4e817f224e520162ca52bfb8
SHA512 af451453c96a518a2665967831fda3b2d8c8da2b743af92cb0333c9645fc7bbc4d22d8d0d583c65f9758a7f4d84114a6e443e8acb07966519f3f544dae42c72a
SSDEEP 12288:91Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:91sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD7523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 da551892433991a0195e68a5478ef601781e051821b5cf681a91b9406ca05285
MD5 6015b6c74ec70fe4b00a2da459e1405b
SHA1 c18254e985a7c1101102dbf51e94636f55564091
SHA512 5b310ba3763b8d2594da04f1b3f33ffc86bd1081d6fe5f0524ad1153e08315806e9d50fbc410610ee97226ea76eb49a93a332c39ee697838ccf250fa798c0748
SSDEEP 12288:C1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:C1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1237523BFA65C41CAE52608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 0f9c789ce1bdc476cf7eb749bc4d2282048a43d53815b751f90cd9d9ddd2df13
MD5 8c7c39e5729db39a60c04905cce1f6b0
SHA1 561e2418dc184a54c85588c6af0175b8771d1971
SHA512 3d1ec2b598c31c0e632cf77f535d9ab417c6cf72b651fd54dc602cccfd93de8cb1d7fa0ae5a437e84ed11cff0a0c394c1349c651f6998f85a07c1e7f8dcadddf
SSDEEP 12288:EyPz5L8sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dzyssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D885125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 39fc3548479da5331b087d3adec083e8a000e8b11f0f6abb7d24d69453f797a9
MD5 3abc8090bf9e40a4a45e8d7e121844fa
SHA1 4447dc8c69be1a9020ee94cce06ba4b96496b3ab
SHA512 7b940d19c6d96004dfcbfc888661b86034eb94ce301cb34a3fa46b9a688d9e3cd9b48b51833887cfe0b6da7b61cf768f846f750add4224343bfdc4005526cc5f
SSDEEP 24576:SToaLl3z0zD6sqjnhMgeiCl7G0nehbGZpbD:STfLljbDmg27RnWGj
TLSH
T1798501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 059e428f7bb0536392e8ea90bde42e0b3b854be2aa7c0f4791f9f47ab52c81d4
MD5 cd11945d9ece1c5a8bb23d6504782fab
SHA1 4827858a748ce8a7a92ed52c646c840f515619d9
SHA512 0ed6ba608d970458efde372e5ec6322f12bc72b59b0e43f60cbd7544a405aab648e7962e58f5daf15dff074315c7fddcc20f75000b48531369c8927296cc4d10
SSDEEP 24576:q3cd9CHKy7GZ+sqjnhMgeiCl7G0nehbGZpbD:Mcd9CHKyaQDmg27RnWGj
TLSH
T18095CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 412a42ffb8832966a63dd5f8e952e0d7dea29899d19d3913b7be5369b062faf4
MD5 d0394611ea32f14e0fe09825243a336a
SHA1 d5bc9e958f15eb076af68520b287dd432817afdc
SHA512 9301621e3639c63320deebf74dc0c7f2266bc721da56741e5df5354646de7b6650a33bc82f96eea7a6255655e733575b83c0ab807a6d06bdedc27d776f52f9cc
SSDEEP 12288:lKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A7523BE965C41CAE52608B5C3E5F14DAC073E6BE92004837A9B7CBDFBB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 7951bb994c2f448b33ffb818f453b85f41042a5e99a4461a5463a22b6500b2c0
MD5 6d6256693f0f039f2d4f1ca5af4ed1c1
SHA1 54a456622e38cc38bbb73ed5acbee9f121800272
SHA512 6aa88827329a090a91e68269e9f4b91679cc42d5ddadc053a427450f5ccf8a5b064a8b77ff27d4051959e990c122911d2ae45e25114a8527b633465fec041613
SSDEEP 12288:TMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A7523BE965C41CBE52644F5C3E9E10DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 9ab0c5b946891a6dce7ad4919ed6da3d00f31174141d92d4051e8918be190df3
MD5 a16675c0a0c1503bda51c267ad320c17
SHA1 10a6470e18b4a1bd386c758d88e41d39d726230d
SHA512 c02f1d71c1556bad81845d74909e43628ef03add00d14816d064294a63548bb268b7d44c92305520b1ec6d85f8b33d00f2d6e7c6e65d6e11d3988b5e7eb360eb
SSDEEP 12288:YfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1397523BFA65C41CAE52608B5C3E5E15DAC073E5BE9200483BA977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 4842b3ba56e9d1812f07340b1f6de299d60bd3cbf2c75b032d6f2b69b29ed891
MD5 ed7eb474eea617d212f0d3424f6c0b37
SHA1 511e5b2168bb039aedda6f6045c1b1332ddbaa8e
SHA512 d614a37f49c7bf3530e73fc963c258089bc8d9e18c7359bf5411a730a661f96e8bf82f95be573d9506c0773060b7603d88772934c114ae20edbb10f159339864
SSDEEP 12288:J1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E97523BFA65C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 9307e4adef9b4dcff67f0d51af59d20113374372e10bf3eda29ade4a20c960d2
MD5 5da8a0db2df6d0d1139ca5372bec96de
SHA1 83b126adb93cccb12e67413f473158b6a9176a90
SHA512 d00f96afae1caa253ac415cdc77d247e6041cf8ab5588b1e4d980e6671a2e05815ee7420fc7c20d52941bc1e44f06947d831846e5d9cf7ab3256abd16ec4bf3d
SSDEEP 12288:jKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D7523BF965C41CAE52608B5C3E5F14EAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 4413a1fb38e108c3bc6e2e0a70c27363144c815f4eec2efc14468f1ef3ccc942
MD5 10fe74e4b4994c58681c59ecc2f5ef67
SHA1 c6325502afe7b2e7da4a5b84ba5ffa02d0defab4
SHA512 d54545db453e887fe15eaba9d2ee31cdbfa38154d04db067047f0cf8c6f842c40b433a8b2a7878d9fcc1fb6499f999f8fb5d165f38424669ea09b1cbea436231
SSDEEP 12288:LtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A57523BE965C41CAE52648F5C3E5E11EAC073E5BE92004837A577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 b598e7375eaaad29e35cf10b4ee72d198245a1f94912bfd2739ec643826068cb
MD5 16733f10e3457fe7ad7617df880781c4
SHA1 ea907de0acb262aa205f11381f05ae8b63d5a601
SHA512 da897663123bf8202c80d322660536a07e7e21cb7f0b8d38d94f72bd488883750a1b5ea69693ad222cb82d6d3214e20db7d5ce15a361b56b1caeeaf3e7ed1ac4
SSDEEP 12288:lbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE7523BFA55C41CAE52608B5C3E5F14DAC073E5BE92004837A977CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 5a7b833f1eb087d13430fe37e38cfc6b4ea0c2f76687318988615fd845ceb749
MD5 db2f00e3b021be60afb5df5f460a83a5
SHA1 742e1f3a454bbe8c9f65ec59d7d67c47335548cc
SHA512 05f2e39c81a8b76dfb98d433e8eea2dd1d476419ca697b32f302f4204903c53b8414afd2eae1b0e95c08657b2eb832239200fa2c52895f2c8cc810201305656a
SSDEEP 24576:Kfwvzk9RX6wkyAIBsqjnhMgeiCl7G0nehbGZpbD:lMnYIVDmg27RnWGj
TLSH
T19295D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 982a659daf72807a4dab65289e06e2c1088356bfe300909df0392e5811c27e0d
MD5 0e9fa411cbf68f53988eb732cc45086c
SHA1 1e9af823559580103808ad242b8c0b42fce3c9d1
SHA512 2b51b0e9915087db58dacc06a7d89a6a4809cd604e05d860297b5678f4afabfd4b1c34a07b7cdeeb05aa7eb9dc4c96f7ff7d53db187022f878f45371b87eb3d4
SSDEEP 49152:+YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aDmg27RnWGj:wySzPSD527BWG
TLSH
T131066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9b8426e57dc7e8a4a61a33b044f9e97901fdad1f98d51f935144a1248ad28784
MD5 c5d48c170b754c85c6158507104344f4
SHA1 e07008295204356c57d2cec7bbede85b6a9fc91a
SHA512 d19867ef3fd32d0466d74334b29e679a4873e80463bb01885008f7b8cc602ca5991340ce197a12cfafba15888ad7d2eda331946fef8029d167b2ec6657c29412
SSDEEP 24576:L47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgsqjnhMgeiCl7G0nehbGZpbD:L47JUQj1irIhCnDHUPfF/KDmg27RnWGj
TLSH
T17A65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e38ac9a2d5e218beffe4aee15694ded7530a36f462dc0ccf0a318be863802d2d
MD5 a9cded4a927ccf9609b1efa5fc2e05c3
SHA1 8aa45cbd2e75b0a3042ed7efb599ed3bb6e3a7b0
SHA512 1d0a94cf7e92a48234b1e18e188477be3a3f3d01bb76353c32bfd730cbddb75fa7f3b383be7b09d6eb578b2f5ae120eae3a6d0b9975a345688556af108dfde4c
SSDEEP 12288:g4sfFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E75015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ad224bb62a47628202e577140f61e1e628923a9fd03f438365d7ddbe638a58ca
MD5 5cd4f50e432e8944b7ff6da7fbcb81e5
SHA1 77bdf4047a4e9c3393f631ded79627814053503f
SHA512 33d045d23b69f355bec2048a39bdbb9fe004fc480b5e1c1e3edba57bc8a116583104b1ec90301cc4b8907ae6b58308a11eda295ff91f06b2c7634c4ac1a556ad
SSDEEP 24576:4EaV8UPssVki+CWS3ORhDBzAxj0cCknn:4jV8UUIki+CWS3OXFOj0cCknn
TLSH
T1CA452800B666D74FC66940321E32D6CDA7B07D41EE44AF0773C88B3FD576659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 f042fa712c53cdf9d4b89773f0e4b2ab3029f0e7b188a0bda80af6a49ad0e2ea
MD5 8942fc618db32c77ca92a0acffc100fb
SHA1 18e0c80afa14057f8cf2904940eb5ab8e675ad4b
SHA512 056d1f548e5e9800dac904c85692a71447a99aae4e0a55870d08717d683a172f11a74c40488add846525423effe272a209bd2d4222077c760e30af06a1dd0026
SSDEEP 24576:IUDWGCWS3TQsVntho0HA+wdif6IEx5nqUiSEfppV2M7oHE:IUDWGCWS3TQsVnn7gRkiIEx5nqUiSEfH
TLSH
T1C255C940E436A38FD1B76171072A5F8CB7A4EC46BB456F26B388453ED82A715A0FC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 53ba7b580b1ba2f69928638bb28325052122821361ca2d09c1dffddbbb917ef5
MD5 e38545458cf30ff0a251234bd4a5b4fb
SHA1 a11b218e5cf6003ebee2d0e2a33c33b2ac5ba812
SHA512 df3a36a4f53a2765bbb58695a3011fd26c9765c323405d136391f383e25c65368d64fe1ed385ab28e00aad2d01c2afc14d5dd5e5356115b6a8765e8f786acd94
SSDEEP 12288:Uu79Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF75237BD35C518AE93605B482EAE12D681B7E669F1044C3B90778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c10f2a03e41ccda61fc10df066952a63d8bfa72a428f6007db8d9afa23074492
MD5 fe65867924220581ced76564fd9536df
SHA1 0b6054a1843392da2a8d7276c145baca92833b32
SHA512 f3fdc8944988751284c33192c6030dce3844ffb021717f3ce617a76fb8601ba3c915a4957440e321700479db7d3e3882239ec069b31f198422540f1023f220f8
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYHsqjnhMgeiCl7G0nehbGZpbD:pgb4mBIBhGFcDmg27RnWGj
TLSH
T169659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 35cd7c5be62036552f0ab30fc8447c0f40ad6b5d8b00b671d777765e4f65dd02
MD5 2e79d3d1c531452403fe866df15a4cd6
SHA1 dfc43b658755507cfb4e620c9264fca4d2752ba1
SHA512 3c1e6bc7dfa1b8be387dcf810d1942e51d67a838d698d51149a6b11db46e2c3b65b327cebc58530221be912c4581ddb5639cc52a9c96f4242cb9c1b063637a8b
SSDEEP 24576:FG88u8FpJqH1Ezria7/mwsqjnhMgeiCl7G0nehbGZpbD:o7ZFPqVTa7/jDmg27RnWGj
TLSH
T1D7A5016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3054573ac39de43ff5a5638afeb65bb06e96db09e06cc299bec63913d4ac7958
MD5 de217e7ec1af0cdfe0eb74c56f499963
SHA1 a458aa2cb825c4939ec050fce5af47da78a55679
SHA512 715c97a4fba15db817cc035994c57e2263717100e978ce62e73176f339f90a11ab581ca4380435c25e5b499cd7aa010d2b5dc8bf0367c2fe605a83482ea8773d
SSDEEP 12288:0HvUrBFrEjwaQ0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:0PUr+NQ0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B085F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b0587918bc0cecb89c2a55e225447680afa9d009645fa6c3885e973976291cad
MD5 cf49df49114ec1e9775849f37d5a12d0
SHA1 eae87d0dec95a007bb715d495f3eff760ff159a7
SHA512 0b340bd32d6043e77bb509e7ed4f9153795b39a81a1a6bfd7d2b3f1d810fc7f774d19e3852d939b39cde357b5a151037ad95a784532b32e1e9c730b6eb563b02
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgDmg27RnWGj:LG05lO43b9D527BWG
TLSH
T12BD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cb8e7022ffce3666af23b50e804851698c3820db9ab1d37ec368c5bac1db3fc0
MD5 eacb9202b01aca8cfe57c19fa67eb460
SHA1 4c9c6edb5aad952cf8805dfd3196ca141c82889b
SHA512 c045d9648af568cfd74e29d8b821b563266ebad55b57c07350a1b910d7adfa83a235dd1d8d83271b92ec9d5dac141012704882568df0483f91e0e35297cf0546
SSDEEP 24576:rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnWsqjnhMgeiCl7G0nehbGZpbD:za5POZ3+Jt2pasx2+m4Dmg27RnWGj
TLSH
T16165BF5EA3FC01D5D179D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b9806f73bcbb6522975e1f559f079caa451652ac2c650f173478af499931a474
MD5 0c7f860a8e363b28ef4429c446cdca1e
SHA1 3cdc9b1a7b7918c9e53a58cdc2225f0e1c858766
SHA512 86f0814743c7b5632d226c395e5c69f20e7ab21c83eec4dd5d93cb92ed1c5513ecc5b5b41b8328932cbb443ae515c2cd7638c6bb84ad84f6c2b7ae2ab928602b
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fk4sqjnhMgeiCl7G0nehbGZpbD:sNc/zEOVHFDDmg27RnWGj
TLSH
T141857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c6046675d32fb1e7645a7c08a48c82f124dbae1ff57d9c20b25c7fa4e20095dc
MD5 92c58e02fe8d7268796e46109e5cf947
SHA1 7d83e39d078331a6a7afcc9be0dd5941df7c6c0a
SHA512 f6a12f34b44956370e3f8fb12cf4861be0c3804175af7acebc0c89b2a4cb61810d78b49121929cb08a5f95e7a7c5a6d89130824f03ef91933e4723863e53578c
SSDEEP 24576:v8kNvNnaFeYhJNtmZBmSsqjnhMgeiCl7G0nehbGZpbD:v8MwBtOmWDmg27RnWGj
TLSH
T19355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 a57117198601c92ee27514953b98af0715a86404b99b28858cfdf1a5e3c03576
MD5 2f9061bb9dbc0acdec6285d543a342a7
SHA1 16bbb67b4e70a0d4fa2f3aae678b86d4a3f41738
SHA512 4900469963de518ba1bc7c7507a303f1a4f7bfe30960da4266b74480d50989eb40935d3c67e53867762e8aafa8decf2cc438b12fe2c6040d401f0d93f04b8d58
SSDEEP 24576:PD3FHshBIYQgApsqjnhMgeiCl7G0nehbGZpbD:PDVHeBIAAtDmg27RnWGj
TLSH
T1E095E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-507-0x000000000E8B0000-0x000000000F12B000-memory.dmp

Download

memory/1516-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1516-232-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1516-48-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1516-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1516-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2108-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2108-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2108-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2776-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2776-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2776-96-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2776-102-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2776-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2776-306-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2848-305-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2848-108-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2848-109-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2848-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3240-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3240-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3240-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3240-82-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3240-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3240-320-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3416-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3416-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3416-23-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3416-15-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3428-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3428-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3428-120-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3428-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3428-126-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3464-45-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/3464-33-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3464-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3464-32-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/3464-40-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3464-43-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4980-386-0x000001CBF3600000-0x000001CBF3620000-memory.dmp

Download

memory/4980-342-0x000001C3EE4F0000-0x000001C3EE5F0000-memory.dmp

Download

memory/4980-349-0x000001CBF32F0000-0x000001CBF33F0000-memory.dmp

Download

memory/4980-351-0x000001CBF3210000-0x000001CBF3230000-memory.dmp

Download

memory/4980-348-0x000001C3EFED0000-0x000001C3EFEF0000-memory.dmp

Download

memory/5516-68-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5516-62-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5516-60-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5516-287-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5812-9-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5812-6-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/5812-0-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5812-28-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/6032-73-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/6032-302-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/6032-78-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/6032-72-0x0000000000400000-0x0000000000584000-memory.dmp

Download