09a627394b17c7831b72fd383b7d46e6ed5875ae4eaccdf7681fd7627c5132e8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.0MB
Sample260809-lw48bsdj4v
SHA256 09a627394b17c7831b72fd383b7d46e6ed5875ae4eaccdf7681fd7627c5132e8
MD5 b2fc01483e35bd76533a66b59085dad9
SHA1 38c32942640108fc1ad6397e755463cc0ad1c6de
SHA512 1d58e7b30a72dad2112f54a48ffd2f1bfc90367c03185759655bfb9512050f7ce265d1390085c85a1f4a8b787276d737a50c8fa88809e26102f1fc5e1790fc48
SSDEEP 24576:mBYGb8a9t3A6nzSpwr3FaQ+14HMCeKFmHpKGNoSSVD:VI8UA6Pr3FaHCbmHp1NU
TLSH
T15E35D015A7E900F9E0F7E678C8A35A02F77B7C460670DB4F03A885672F676509E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1732	alg.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
5020	fxssvc.exe
2124	elevation_service.exe
4792	elevation_service.exe
3684	maintenanceservice.exe
216	OSE.EXE
4216	msdtc.exe
1236	PerceptionSimulationService.exe
3000	perfhost.exe
2256	locator.exe
4452	SensorDataService.exe
3920	snmptrap.exe
1244	spectrum.exe
3168	ssh-agent.exe
1388	TieringEngineService.exe
820	AgentService.exe
2856	vds.exe
4804	vssvc.exe
2392	wbengine.exe
4208	WmiApSrv.exe
2536	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7cad540f7c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000874df63de527dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000885d473ee527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073d25c3ee527dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4f2fe3ee527dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002405123fe527dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096c30b3ee527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b711fb3de527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000686fcb3de527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a106f33ee527dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a339023ee527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054e9123ee527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000404fd73de527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
3128	DiagnosticsHub.StandardCollector.Service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3948	2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	5020	fxssvc.exe
Token: SeDebugPrivilege	3128	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2124	elevation_service.exe
Token: SeRestorePrivilege	1388	TieringEngineService.exe
Token: SeManageVolumePrivilege	1388	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	820	AgentService.exe
Token: SeBackupPrivilege	4804	vssvc.exe
Token: SeRestorePrivilege	4804	vssvc.exe
Token: SeAuditPrivilege	4804	vssvc.exe
Token: SeBackupPrivilege	2392	wbengine.exe
Token: SeRestorePrivilege	2392	wbengine.exe
Token: SeSecurityPrivilege	2392	wbengine.exe
Token: 33	2536	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2536	SearchIndexer.exe
Token: SeDebugPrivilege	2124	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1000	2536	SearchIndexer.exe	120
PID 2536 wrote to memory of 3408	2536	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b2fc01483e35bd76533a66b59085dad9_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1732

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2356

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:216

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4452

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4904

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:820

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4208

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1000
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 368a0d9ea62bee8aaeec93b8e27708c4035ba1fe5c4c79bcf800c7d3eb148273
MD5 bac390d33c1920fcfa30d4027d435dfb
SHA1 41392ba7c58fa2d8c23973a8babe4697f7990596
SHA512 34cc15ddffd87c089833a93f26a1d9381dbcc5aab351afafdc5defc2ecd8ee0ec6be0d15ef4b50409f866ffa565768a84d02a494b23509b4f4472d9993d0690e
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4r3FaHCbmHp1NU:/3q6HjBp3F3sHNU
TLSH
T165D58D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 2eee0a956def7ef9511ef89a166554287fdf6c727b594e8061c07a2d8e11e786
MD5 b5c29cab807388fda2fa2fc6cf71ed77
SHA1 a34e25ab493b5b32802cfb1053263752b29cb69c
SHA512 2399211459d46cdfb83afc54d3215c999d636712ab586e9f862d26172bcf2cd7236dffc8402e88fc9a8076c98a669c22ba40c8566ed29096a88faad0c0ae689d
SSDEEP 24576:KXYfDtczAlr3FaQ+14HMCeKFmHpKGNoSSVD:RtcOr3FaHCbmHp1NU
TLSH
T160050224B7E408F9ECA7817CCCA2C511EA7378914750E79B03A48A661F737D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b1e538b8cde4fded5f7c4bc04be9551425b3e436936885ce0b80c70a3aeb6e5c
MD5 761f8a0a52366d9b8fb9371ec6afe535
SHA1 79614fdd688bffc0b2f05093c1a01b04523d21f9
SHA512 febf376781f2b432df3a01fd925240a2a42cfee23b9973783720706776f63ab85517b6badab202f48c29170f7aa53a5d60ae4dfce0e240c380a9136cc6e9361a
SSDEEP 24576:K0Le5ji0hmxirM0r3FaQ+14HMCeKFmHpKGNoSSVD:KPji0Ac7r3FaHCbmHp1NU
TLSH
T1FD359E15F6748375D073C0B9C5D2A68AED7230825B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 86dd5c657229ddda05b82f3a74fe892ba2737f52d53afb5c94d5a5a8387801f3
MD5 48099f17909f56d3dd0ab4a8361808ea
SHA1 614e608e0f97d3bf9032f5b491b4c47a66311a7e
SHA512 5a1f6d654994086d44ccff60c0e40634914a0986415ad39c6ab89ed60ecc72d1b017eabef3e952a44a6fcb078fb47f99f85aae4c76e4484aa3216234ac12ee53
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWE6q8wyuOr3FaQ+14HMCeKFmHpKGNoSSVD:0/ezSC6vUzPvxHjyvr3FaHCbmHp1NU
TLSH
T10C755C15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cc104d5c1d8072aebfc6868fbe894482bbf53816f573730a11b656dd401b1f98
MD5 16a6b66861d00a6b6cc9e5bfe567cdf2
SHA1 81fbf62d941e796bb9bf603b2d0b43921a96bbaa
SHA512 14f96ceef709d73917bf65eb173f0f9118ef0de14bffd1928b4ad76219f32acc7d5e439660613837539960d12442adb761da0c45df75191a0fe28b30712c0f10
SSDEEP 24576:0VbqPb88hv/l+6Rr3FaQ+14HMCeKFmHpKGNoSSVD:0VO88hXl+Ir3FaHCbmHp1NU
TLSH
T175559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2f026a7d971cbefa8ae7399521595074a9908ed574d6c3de202148e19ebb86a1
MD5 8733f080f392f46546a03c958ac450b3
SHA1 b81f0ddcd2f2e429b615716881cffe9600445b04
SHA512 d4befd643f44bc98cc90eb6836407be637f819219dfb1e6f17cd4195463ce40dc6325e2be1a0acb66687eb2786c7417705df260fedbc59392cc8752134067e3d
SSDEEP 12288:2RVGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:2RQr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T18EC42310EAAD40E6DAFB9535D8A6B1C0FE5BACF15C44CF035E205FC61DBB898F15A182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 93683e12a9cb443bc1b2ce4c81eb0741a51501bcce4d6d57bfbd674405f931ec
MD5 8b7f1b71fb9e3916f392aa1b25f02c2a
SHA1 9954c83d7938e59c0a69413e8d4ab8dcf466855f
SHA512 a32bb7abf242009f8431e014c4f81a5226f2b9a407b51d6f0d17732dc1f9ca9aba99d93d6c14085bee89890eae0f3608cbb57002898c867d59a317b32de69dc8
SSDEEP 12288:8eBNUbTVO86UUGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:8JIUpr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T17F05CF3BEE28FCE2C27A8D795A91C240E77278704F5193CBD164834E9E235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7f6c8f877f8bc22c7489541c8fae2a76b507d43f1d741769134539e989878e72
MD5 4cc893c397359dabefe0812129827885
SHA1 176a7f9aae168c59bd8e07867840e031d126056e
SHA512 934b34b8996cca04d3b16a4a2c45aba8d57f100be50454cca3aae1e9e72a6cb31a21c8b2d6bdc88a1ab478f119b8166e8e9fe0bd63d927e43952cb02d02b9cae
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:+QvGAdlCEL8c/yRNw5Ck3F3sHNU
TLSH
T1C8266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0fd1f409164776d091f8ae01b09160874044ee7b087f362b35bb410f90b3d412
MD5 c89464558b5d1093fdeb0550b3fcaeb2
SHA1 e30775cbfd4f715ae8fdb714a8b8c78024311102
SHA512 eb01f8fb8ea81a20328bd0a736d5d900d354d48f5553b1b20fce641141f0402fca27b3cecf105ba404ab8627b9148413d10393e6d2b7661b41b8cc9eb737f1e3
SSDEEP 24576:sdewsAjLr3FaQ+14HMCeKFmHpKGNoSSVD:0ljLr3FaHCbmHp1NU
TLSH
T1C715E031FE74E036C6BF0DB21B36D706682DB9604F511AC3E3A84E8E59742D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 370c1a1820301dcc85b4b29b9e5cb962a00877d0ec0b2d0de81d7fb5946bd7ab
MD5 a80befb0bd354cac298c171db8c5f9d0
SHA1 3498b4406bcb65073aaeaeaccfe6cb51600154db
SHA512 15f5eed10d10acd25934d4677eb9f3e2872c8aa1b27a2960c411fa995f6bfc9bae5364cef0869a3fc2536a84f6c4dcc75a8534afa6e017633e41e3986ba6ed0e
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnCt:qUEtQevvqc2W1cpV2EI32E
TLSH
T144474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fac9dea98a520d846b5c092704f9295897c9e771a326c0a36ef0af3e93e3a776
MD5 a6a69f2a726ef9407947d9b7f99dc87d
SHA1 cd749b19727532b8f7166b476a6ea82c0610b387
SHA512 073caefd7ad445d42bc05281365680d9e2a7c1f4460fecd7e360f8b20c47cf0212a8b4f93ef4fd13e8e2a23efaab880f9c4c44c2f15981c1659b3b1772b45cff
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zrr3FaHCbmHp1NU:foqtVjnmY3F3sHNU
TLSH
T1C0D58D0976B8C2E4D1F6C77886A2C647F37178154B359BEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7846dfba47fcdbd4124ebc2e0b21c3cb92408a832c9c549a1a1b3ceb026c0eb6
MD5 5ce16005c035f9572f7bff9282bc695c
SHA1 cbb001f3749122af1ac522410ba11dba970a8439
SHA512 665e90dd1a15fd53ba204394647df5007153f515a8d2f97aa6546400c216633ed2ae09271c538da6b797097adf884e28f510cc3ae7e25601c08c0fbc14f01898
SSDEEP 24576:lAhGLJIFoiwtA5l7S53Sr3FaQ+14HMCeKFmHpKGNoSSVD:lAMyFoiq5Cr3FaHCbmHp1NU
TLSH
T1D1359D81E7F955D4F5B3AA7899B69170EA76BCA65E31C20F2160C20F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2b3fc181e4373d59343eff1365495e27201012446fe1480124cabbb524fce2e2
MD5 f47965121192e5d4d1b389f624527513
SHA1 af83982ff637f20bf1e8d85b24ac909538fd6d97
SHA512 7201c46b75d5f8d68362775dcba14f0b2742f5d0cac8161e8b4a4050a945fee4574e7904232e5e69afefd07da49d00cd1e6849d73d6268d7f52a36e00c326d14
SSDEEP 24576:9wuoOWPr3FaQ+14HMCeKFmHpKGNoSSVD:9wDOmr3FaHCbmHp1NU
TLSH
T1F005F14576A80CF9E9A78238C597D131F7B3B8522A25CB1F0760C75B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c9b3d61b5c0f8ac2417a247f7e9cfceed6f82e268c5eb26abb887ff0819d8aa6
MD5 ba2b9b451ed6b1277b24ec6fd014713a
SHA1 120fb7faa5b313f6db9943f524424f2f0557ab73
SHA512 480ea5efd104b712a1c4eaac1e1f6c8b2d84f1009111afc8b0f29318c2f52372952000dc889ba475a2f08ed400d5f957ac34ca49abb186d6412dcb54acfba538
SSDEEP 12288:OBZ1IyKGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:IZusr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T16FE4125577E820F9D1E7823CCCE19284E77378A22B2583CF16204B961F77AD56E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 092cd3f87bcfe6162525165df00347ea307bbd71a99ced5a123015209add6bb4
MD5 48fa57e82e7ca8207bf527de7923081a
SHA1 af8825c56ffd8336842fa2244e3aef5fe79a3a36
SHA512 8c9afd2246ded7b519fc1fd6178d3fca2304ba975ed570b35004d0035d96c383d0b9ec3650e4374d03f9509ddd180e2650ea82759e71fa3cb0dc494996319c8c
SSDEEP 98304:iQRQyi36YOcPQLvw2gAf+PN3V3F3sHNU:5QyiKayX+PNtCt
TLSH
T1E5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e2d19c995fed2dcb0a9d798eb637763cba44c0e77a00a311b5dd45f679d17755
MD5 83f1cf3a8782b731bb1346ce3f383b38
SHA1 68664992e0602873bd5eecfe58b209681dc05cdd
SHA512 fef1523600bd712c6ee308d441a86da27092b1266dc6a26e8e7b40573fbab6dffa5862f0b4ee05578f82744d537e248448e5de0af8deb7270b7f9a70de731767
SSDEEP 98304:JQRQyi36YOcPQLvw2gAf+PN3V3F3sHNU:gQyiKayX+PNtCt
TLSH
T10C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 33432739518be9f72029668b87fd759edb28c48e473f947b52fd78bb3c9346a4
MD5 0b6505f0a9515a14011089fe041c1798
SHA1 0ff1aeb36b67289ee35d90b73ac51d11a4cbd226
SHA512 0cc126269f7b15fa6d886e8ad8fa529668e997f431c61939635f3181fbab12218f1e5f3cb27e348da7a27e7a2244c143a50a58615961ec448be954c9124ada47
SSDEEP 49152:Y68Qg55nhheWu7PNU3/7r3FaHCbmHp1NU:ithWRc/v3F3sHNU
TLSH
T13FB55933B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1cb8cc724ff8261ba0f08e55fda2bebd3defb041ac6ed838d75864079495dd44
MD5 5d163d57435daa2abdb96414ec52e54e
SHA1 fdba376ae68af9b0d26f753ad35fbb70592ef1dd
SHA512 75ea1da8780960e36fa2b460a27b1a6b389108fd53e28140514a0c2aeaca30ed2767a55fe1232ce6f78fad3c9b368c46d9b44df597f6dd628939db1c721f187a
SSDEEP 98304:Ay5112gYy5azzVvL69nLKnhZy3F3sHNU:ZLIHmWhICt
TLSH
T19A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 808ac81629a715b948cca16aabd1cfd2793aed3360400e6c32b8359a0c8c7230
MD5 ebed318eb9065bff4d73fdaef0a899e5
SHA1 5dc7c89e67f7837e3504c13d1b61a729c577f624
SHA512 8edc7fe79dbe781f44a19d317bb12fa0ef64c17ce06041d626c3cd6e7d32620b5332dc6957216cd9505cc1652b1a02717c37f00c4859be4b5902bbdbf210e213
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1r3FaHCbmHp1NU:ou6JmVxd2dN3F3sHNU
TLSH
T1B3D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c61f26a16cdbf184ece740722e86ea1661fc1829b4c4bf6a4e8e36865790c06a
MD5 6235d0d04a407cb4e0d3f2b133e1501c
SHA1 bbc144c42b322e88c55dce29a236bbea3b074e04
SHA512 5570e58cd5cbaf2b4a5f96cddee2a3df26b6165e5c122c2bce8757fd4e7a863b5f6fab4d26fade79c2ba8d645db77da8e681f85a6e195133fee7a2a022c3940d
SSDEEP 49152:11hpsNoJpF1A6UU44CwH7R4xJr3FaHCbmHp1NU:1mifPbRY3F3sHNU
TLSH
T1CEB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4b5b96ee88d5892a33ba4905ec1664c095cdd655509282aac8341408c3e79f54
MD5 4a6ebaf9f4639ee90ef724c0f5273a2a
SHA1 742f9b085b99103c78b77221170995d529285b79
SHA512 6d35d6b8545d727e23a00fc169808a40b628be09b12b807aaf2188f457b41f39d100298b43f0a04e2e5fbc84ce878bd1bceca7cc01fc159bf4e3825bdadfe22c
SSDEEP 49152:jSuZQIY0Be2KRRVtOnks6NMHqsr3FaHCbmHp1NU:B5dKTi61e3F3sHNU
TLSH
T160C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 28b9e7c7e935f7b926756323c86c43f83ef50b20caf2c7e826c76994c6ebd862
MD5 4c3d28ce14fae9782971aa6b77e087f9
SHA1 9fd1229f8bd70624db646a8b96513d077a30569a
SHA512 8c17516123ea9ad7ae80724b3c96ee863b7cd3e39d9194d794cfcfbd42b731e1496aa872c938ed86b3f0a1aeae210f82107ebfa329d5dab172e06b449b636bdf
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5wVr3FaHCbmHp1NU:DX2iyph83F3sHNU
TLSH
T1F695BF13F2D900E8D05ED178C7568632EA62BC160B35AAEF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 cd9355567375286a752a4ec72243c6ed0cbb690065fed82eeddd8ee922144f65
MD5 2b2316280781e1c816a2f847fb5c220e
SHA1 d26828769d8f055056b837b751a9293219669fe0
SHA512 23696d6846ae6a49bb078e73e33df07ba9ed61b42ceb5190e7d2816d8e731acaa64e5626519ae4b49cca4544d61e493c67ec13c44ed9a696897606a5d6aff0e5
SSDEEP 12288:LNGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:LIr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T10BC42300F9EE41EAD4F68575C862A2C0F94B7CE76C458B536F240F822FFB998B15A4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 32ec61bc28338264f9cabb83c171bed3f130e29da3501cf19ebce9fe408e9f7e
MD5 e45f31fb23ca1d409170ffc0cbf0dcde
SHA1 e3b58c509167067de51a58c1f98883f309a9ada8
SHA512 abdcd60643e5ab1a828dcb6e50c4f90a43b0e9045a36281fca686b6c989ab9ceaecd45ccaa7e3818e74cae803738596d21f0f8c4d4d0b462df053ccedd5af7bd
SSDEEP 12288:mWGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:mXr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T120C42310F9AE41E6D4F68575C852A2C0F94BBCF77C458B436E244F822FFB998B25A4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d53c64e2bae59a7bc9cab0a0f17535d94d07de6b90369465c3f92b0e89df8ed0
MD5 d18e7759249e60ebba6bea74e23065f6
SHA1 d8ef1a6b1f5c4bdd3c841cb7f7cf638dfe7afe11
SHA512 fcb00c3af0d72fafb853c850b4af98b82f42e025311dbf1d296ac7f7886cc15af187ac2505b10223aa426178a28f04256ef29b69348b3288c0d5e53972d0b2e0
SSDEEP 12288:bMGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:bBr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T106C42300F9AE41EAD4F68575C852A2C0F95B7CF77C458B436E240F822FFB998B25A4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1c7a1bb7f712c272afb128b6dd03e8bf9e24aae9bf88b6b74faafca83f534acb
MD5 8902d30ed75bc3906b461d082eec91da
SHA1 d721478dbc05ad5547bf9506b8a1e82ec1796d96
SHA512 744b94afa1a666a32682df77fc6a13c444dd0eb34646cee1fb4bc0fc70ec3988a0c85372c9f232aaefd4f70630ad99dcfc7d2de9b6127a5d7f8a9a380c1f2e1a
SSDEEP 12288:tVzGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:ar3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T1E7D42301BABD00E6D8F7D274C862A1C0F6A7BCE26D018B9F5F100F861FB7694B535A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 43bcba48da218f8ac4e765fe66e46341c8ca9c0cb53dcd0bf7800632af2c66a8
MD5 3f81539a9307b130aea3be03756946e8
SHA1 b2962bbea0fe777a0cd191bf828c02a6cc67922d
SHA512 202f649bb44bea27843d6d210fb72b981ce4ac97041e973fb1c886d56508e8c968ff2898c149480e67bfe113174db9c7b9e1229d998a6f5b64a12fce07c2df37
SSDEEP 12288:ybGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:y6r3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T195C42300F9AE41EAD4F68575C852A2C0F95B7CF77C458B536E240F822FFB998B25A4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d0c1f21ec9ba01edf9f8bbca08ae8aaad8f3a3c8acd8ff182fee11289147187a
MD5 162ba2f3d4a742fc49f3de09f66dae9e
SHA1 ec74a9baf8eb4243d8262de90cacf440d9adcf69
SHA512 cad2ffd00d2f4eb6abfcb4193e0098aa83afa62fbd39c50e532f42e2839989320470b7f85be0f554744b289b9c6954bcabbd79b0a3ea08f4c67d105aafed38d5
SSDEEP 12288:CyGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:CDr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T12BC42300F9AE41E6D4F68575C862A2C0F94B7CF77C458B536E244F822FFB998B25A4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 06196428c8f06dccfe9bb36cec11baf04e6fde0bb41d5490ff1d02ea9361e81a
MD5 d155b691100e8b3ecb7a02faa550c98f
SHA1 c7a043e6684bc8195d47af7db7df60e29afda90b
SHA512 cf80c9b44371af821d5a67e4d05264bdd59f6c68121cc1a4e073ccece889639bec4b9b640b3c093ca5005dcc71b6263876520493282b50e132e76dbeefe709a3
SSDEEP 12288:XeGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:X/r3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T1C3C42310F9AE41EAD4F68575C851A2C0F94BBCF76C458B436F244F822FFB998B21A4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 548ae0412808a53e601981c8dbb9bf137583d75d65dc6399ae79050e9204866a
MD5 5c880a97db165f83b62694aa197d4e8d
SHA1 7e5d70bde3666057a71fe23638dec654ec578057
SHA512 c44b36a01dd58cb7145c05f1cdb3d278db23ed611d2f33877f8130b3cb233543b9559ef612b8b7c9287cf460a991998fc9285df2841c6e153d63ae9ee29d3241
SSDEEP 24576:1ZMSzFVSO3r3FaQ+14HMCeKFmHpKGNoSSVD:1ZMSzfTr3FaHCbmHp1NU
TLSH
T1EE050194B3A018F8ECA7813ECC659945E6B37C6A0A60C61F07A437571F733A11D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 6ff7b8bb5d0914bb1383a9ee75b98796f0f8405b6a4c04cc2d1d18039f467384
MD5 296c5a380e37050844074736e09a561e
SHA1 8723d8a9a3b64a9185f294f1c2207aaa7c9939ca
SHA512 8680274ad4e8f8c6081f2888f972e5b621533dd3d32dc44ba712510517de87d21d99ed5d11bb6e43289b56477d1172173c9d9f8677e9ec1a803574155b93ae6a
SSDEEP 12288:ShGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:S8r3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T180C42310F9AE41EAD4F68575C856A2C0F95B7CF77C458B436E240F822FFB998B21A4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 137eb30fb5ee2f22c739cc2f10fafd10aa87f2d3b0c27e1d5b7fc0946e388f05
MD5 131a209a1fd229f5a53cd40a11ad0188
SHA1 644e46012dde9025a4e32c7796d730b2632a84c0
SHA512 a0edd7f1833438db4a29f2a740700ec7237285c25bb66a4fae914d96066edc814c9b4cea668ae656e85dc05fdc433c529a053f6b25e557b298cca767e63c5ead
SSDEEP 12288:mlGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:mgr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T100C42300F9AD41EAD4F68575C852A2C0F94BBCE77C458B436E244F822FFB998B21A4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 583a499084de30746f3ef0926fc466bf958344f003e1538075cf51d169fec490
MD5 0bc57f9ac173f7df4e8ffe2f1e7f4e8b
SHA1 df1bcdcf997817cda12bf20043ad74971f5b5c20
SHA512 9dc0c1ea5685d33e71817849a1b8b1f1656e0bef37a8ffb4557082dab146edba219390896fea95bca40f2c274d8600ef7deeac3f07919f2dc17343c5977a4cc7
SSDEEP 12288:/yPz5L8KGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:yzybr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T176F40203B7A520F9D1779238C8A25641F777B8721B148B9F17600B762F77690AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 fb6847c63f5db7fbe1816000264db2a19edcb8dbb741f20fd59d9efb9c0b2d35
MD5 6e7152aacbade5ae3ff9abca1f9c52bf
SHA1 9bd4908fc6b12a183cd7b7dfa92817084df2688e
SHA512 e62daf189cd7e812504d793d4504e018f472b7964881cba16debf9f8fc5e89f66c13ed01fff1b7fad828da240aecc6940ea5730cee6171d2efe2c886e90f6313
SSDEEP 12288:ChGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:C8r3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T120C42310F9AE41EAD4F68575C856A2C0F95B7CF77C458B436E240F822FFB998B21A4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 3b25af29a07daa90dffa3a2c84672207dfa41c57180b04e9a868d0246ad5c78d
MD5 43c2b803d403d1871fd7664254ade953
SHA1 c42c5a6135d063ede23e1e6698126e20c9b213fa
SHA512 3157fd26322cb9968c796ce6eda8a24fc1f097c748c56c71bab583da4a23b5c391206cedb63c44d05dba60bf6563a4d04863b9d06dea6125d30cb6949871f0b8
SSDEEP 12288:XhGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:X8r3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T18AC42310F9AE41EAD4F68575C856A2C0F94B7CF77C458B436E240F822FFB998B21A4C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c271b495088bb537ec61ac3d6b09a1af34708f06df4eb0a81d207c1be5357853
MD5 86f8627fb2058bf0bd85619ea16e7bcb
SHA1 481b7b3479167153098a2fa9706fb49315dc0f91
SHA512 bab749cc9ddce0904527d135c375eed693f0bb13e60d26d7f6393939c46ac5110ef66be142d2a612b3b00b7de6b79271b14285ad90ece23c895dcaa8ff7bb780
SSDEEP 12288:ByPz5L8KGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:Qzybr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T183F40203B7A520F9D1779238C8A25641F777B8721B148B9F17600B762F77690AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 0c0f08779a2a0a0207c46c26598212463ec64ad99b596a5a9a4c1d20a2efe11e
MD5 ae5b0a9e01445249835bc9c7cd632287
SHA1 759604c51396db7bbd6497a1a75a889c02346cf1
SHA512 20107c884a9fcdabeff010c4bf0926905613d8062dcbb7d48cc5e40b179baa84fe013af7649e505642b6ba9d6907f61758a018a3ae2720ee33564bde737f9435
SSDEEP 24576:RTHaLl3z0zDxr3FaQ+14HMCeKFmHpKGNoSSVD:RT6LljOr3FaHCbmHp1NU
TLSH
T130050194B3A018F8DCA7813ECC659945E6B37C6A0A60CA1F07A43B571F733A05D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ceaf275604f777bff46d653db7268df5375ea93287abc14bf4328af67b77b297
MD5 5a6e3db2bb5b18e6d3bed783dacbaa37
SHA1 017e53c3183003c991ab317d6ee8734a6c91f1a3
SHA512 c68f09a14437e05949126274bc38f1e15dd4d0216e4dc5f48d28c865a34a07799b5b8ed8970efcd6c66fb39067de3bce3a7ab10784e4a039c35175c3a8d9e35b
SSDEEP 24576:h37d9CHKy7GZNr3FaQ+14HMCeKFmHpKGNoSSVD:R7d9CHKyaTr3FaHCbmHp1NU
TLSH
T16E25CF90F3E410E8F0B79A35CD765511DAB67C9A1B21CE8F03A4265A1F33AD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 4e7a0978fa1bcc2e0dc5133ece27484ed19f35525b9059ed3783bddb350d0db3
MD5 afc8ffcaceab3c531f3077693e7fce16
SHA1 0c9d3c985f6468206e83942742dd810eec9e7034
SHA512 d2627e1180f0921c91afed9e8c12a1b34e8a74462d0e2a65336395e536b7f5281f8bbe242f0d2ce945f49822928c7ca9fcbc24412cc49ca7e0665257e5f6330c
SSDEEP 12288:CsGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:Chr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T119C42300F9AE41EAD4F68575C856A2C0F95B7CF77C458B536E240F822FFB998B25A4C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4b85e5fcf191364aa30dd53e4dbc14954bfc963ab49c80201a5d4c722f67d864
MD5 8cc689a57e1afd03fb107a93ee8c4433
SHA1 6d963df8f4e643c64822732fe2a322e55dde71d0
SHA512 1ea5bec0e2720c21af067ab04ebad17bfa96d17ce3a04e28d9a208e559e7b510b83509e35c215bdb3dabbc933c80db7f5e849aef30fc7851c9b948d47c649789
SSDEEP 12288:bqGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:b7r3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T16AC42310F9BD41EAD4FA8575C8A6A2C0F94B7CF66C458B536F240F821FFB898B11A4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f887727a050df8a4ed609e9a8f4d352256c6c2b95a998080ced5316a1ef7c600
MD5 2dc79b652811282a0ccc54d2d65271e1
SHA1 91e7a7f52c000870727d2eaee31d58deac79d036
SHA512 c4f7e055e8dc38f14de36c10de817f2502c51aa9a9877201cb3b637c4401f906b6015e42f4dadf47f758423aa7472dce75dad2a8e27c0ad799f8bf54e345ad11
SSDEEP 12288:x3Gr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:xWr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T1B9C42310F9AE41EAD4F68575C852A2C0FD5B7CE77C458B436E240F822FFB998B21A4C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 3d36d53040123abbbb7d6a26665c895b522b6bfd4b02ad74dab0722a8b6cea6c
MD5 d3089dc82ed3549277083a465ebb1db2
SHA1 cb1fc77db138b025f48b50b9495f5228a17b316a
SHA512 9b8b98ed415327d66a91c9c0dba504efedc00e02e21d8010b8c3e830148a5b3c25c75757ee18941c596a103f7851810719f64e406e862f2d2a43df58cdf7d7a9
SSDEEP 12288:MNsfRGr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:9sr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T140E40109D29802E8C0AE6135CB525680F7237CA597E1C3CB57D0FA7E1F76690ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 ceedd9147a6c58e6c03261298642acce0fbfad97843af3c2a89c815a8e3ef359
MD5 396bf675cc630a59c7c8daad39582ac1
SHA1 93a9ee24552c3d19834be30a79838642302c93bc
SHA512 5f21cfffe42479f3a28e55df7b34b746b12bd75ef09dbed47c0c70b5c3e17a01371955d55bf14d39c774964f4348ed83a992a36b1642808da4085fe6cdb13e2d
SSDEEP 12288:1sr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:1sr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T13CD42310EBEC44D7D4FB9670C866E290FA1F7CF16D04CB47AE100F821ABAC94F926646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 52e80aa2fe4715d6dea4e674b069c34c09fe269d2b93f66ae10b902f50e22c23
MD5 7a544279991ed4eb626b46da0e42d5fd
SHA1 caff16d1e426e929808201fa73186e944a7c4803
SHA512 27d8fa9bb6c008e27a6d999a94b0ad4aafc19ccd4ea12d9f13cd7d97290f5e63ce95ab530701ce6940a7a287de584eee0d6a180b89d2ff26c8ba8a555390089d
SSDEEP 49152:ca0h2GEkuAe73q3pp46zwwQar3FaHCbmHp1NU:ca0hNYG4JwX3F3sHNU
TLSH
T16D85AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 0a95a75c6c9f60cf40305ab9935fb3cef181c44ed1301e7e821f400d7d30bc6a
MD5 120cb10fb729191ef4133155e8a0d9db
SHA1 614973d7af57fcb10ce11f453102f9d7e76c310e
SHA512 2d65e61c9d76659e3f5b72d9b48d20c551dddc2f596b680d4375364118e7be9841cf8b103703c2a302734f601427d145d88c99acf45ccdebd1e8854e54098408
SSDEEP 12288:rhbHjfXDr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:rhbHjPDr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T1CFE4127D66AC10D9E1B2E17DC5528145E732BCA61B0187EF2790827A0F3BEE45D39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 1d25a7cfd3fd8981c9b035eb4783180c2509818ccdb4a649359c023ad1ff86ad
MD5 1af8dd7cf550e2417b4b50a0891dd309
SHA1 ea8025776cb8db5c031834feaa416c54ff532256
SHA512 0940cd0b674bdeaf957bf01d118d8a2b0f7499fdf664d19530476307c89d158dfbaadbbeb92fe16e4dc010c76bbb9f968c3b770808e5cbb52ecc0fa45ca14905
SSDEEP 12288:yIr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:yIr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T11EC42300F9AD41EAC4F69675C852A2C0F94B79F22E058BD36D244F821EFBDD9B5361C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 b2b39161969df7d0c7cc362d1ec946ad743663b7b7b24a7f4ca49162e94db984
MD5 6ef5914d6e26c4786ad5c2baaf013d02
SHA1 7a6f4d68154c436f02fd02851640662f227afac3
SHA512 6bc95651856de449294337fa727879903b892c00d5b3afcbec51f648dbba60e8f229404ba6626b29853e94329343824fdc2b32d64f290402e404cbe2bc9a7857
SSDEEP 24576:QpL3UT1r3FaQ+14HMCeKFmHpKGNoSSVD:QpL3UBr3FaHCbmHp1NU
TLSH
T1AF25F115F7A400F9E8BBC13CC8A29612E672B8AD0754E7DB07684B561F637E18E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 0ff04bd170be968ac26dcca4ff1575920ac7740dac1ba2d8805db325466bb7d5
MD5 0b0b2d1b60388f6efd4642aa59bb5631
SHA1 5c3aa208df6536474f91b2dad1ca17c6db06fd3d
SHA512 ced98f5891a67f4b72549999f347c1c3e2d8f5714226fe1a32001edbca7ea8631a301471185346ec7c73d61837d3074c30d3d45ca5182b343b3a258bae6cfdba
SSDEEP 12288:ypFtpOhr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:gOhr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T182E4121536ED10E5D4B6913CC9929348E773B8B21B0247DF069086AE1FB7EF86C3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6681c3b995a1babf856f90c291a3b168519249b0932767508ec38756c5172d0d
MD5 5387427e833e8d799605588dc4655e11
SHA1 e5da701a28443483b0543ee31849050e10ac0a7b
SHA512 87c3939bd35df11809a89c395a80a299fe49364b8f91f6ada0e76a9adad2bd7d87f93e43a9b2308b02158378182978e35db2b3cfd2b74b6e09f391e10d77a81e
SSDEEP 24576:j7NM9YqZqmWMUkPjZM48Mv6bEhscr3FaQ+14HMCeKFmHpKGNoSSVD:j7cBWMpPjN8DbEhfr3FaHCbmHp1NU
TLSH
T11E65AE2E6BEC81E5D477D13DC9A28245F6F2B4611B318ACB1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d4989fc5857a192d9f98fa3e5ce7084fcf79c27c0de595cbcefb9049a83cd119
MD5 8ba2ed7b2f1277bfc748770765b76053
SHA1 48f05439c7745a21e3e1e55ae230a32f30502779
SHA512 f6d4d32aac8605d9f9dae7c03379b93a4df9809b7ecca3f8d0fb6ff5d3aca36b6739bde77ebeefeb922ae19a967176cdb9a14736c2a2077c4154d144c9a4509e
SSDEEP 49152:YF2YuHNETovAvNYf8km8r3FaHCbmHp1NU:d6BCf8kp3F3sHNU
TLSH
T141858E2967ED80A4E0BBD27D85B7D246FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 902fa2a39dbcf319393644a6286434e5b38ec8744dd24283927242eb0d02fefc
MD5 ec3190fd9c044ef656e437d979162fb0
SHA1 e01a9de8f640db24b411e747a7c79ba81e3f7fa5
SHA512 bc60f84be1259bfaae1335dccc676c2a21e35a3d52d48d9fc130a2df518a4d75ee58d3dbfec2e2dad7b044d774cc1e9413ee29f555f2bc2cb6e747b87056ae3d
SSDEEP 24576:HAFs06+Omlf3NXEbToNr3FaQ+14HMCeKFmHpKGNoSSVD:gFs060lVXu6r3FaHCbmHp1NU
TLSH
T1B665BF2F62EC00D5D07ED17E8997C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 258cc960edcd7267c92138b540ba567d66d78d6c19c0b9f2c2fe92e2d812b8f6
MD5 480ba27e2d27b04ced457c8ca51e0199
SHA1 3883f3836bb5aca57c2cfe25f154350184fceafb
SHA512 abb4e6f45ced6245d78c5b20c90726adf4ef205103832775f95270bb7e829d4505fb3e1d90b8357de3eb43255024532aebcace0135236b004b4b535c1fdffa0a
SSDEEP 24576:wJnJ5D3WX6r3FaQ+14HMCeKFmHpKGNoSSVD:wJnJ5DGX6r3FaHCbmHp1NU
TLSH
T11815D02DD2A810E8D4B7C274815A2785FF72387D2F226AC72874D5353F12EE0AA79F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 aafd9a5ce4d0b2aec7b03bbba1ef7f232b3a46c78f928932b4ba375418162f61
MD5 d753d54b405d6cf8ef796b39b7a727d8
SHA1 432d7a380647a5a2c96ba2a1f759164b3f87122f
SHA512 cbbe51b18322a5605aacfc5297730d550bb1c04df0cb6367ab7a0b1054414a56210583fcfdbc5cbdd820e28f91985ef9c9c067b09a379b5b8b00cfd24bb3bae8
SSDEEP 49152:Eg06DIKdwc+eQnSt65aVgr3FaHCbmHp1NU:1k3F3sHNU
TLSH
T11F956C15BBEA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 0d2e047cfcccd3d1e57062602966a38a8ee763c9a940c9b78a883a0b6f69e9d7
MD5 6093aaf6e537010161b7ac7cbdc262c2
SHA1 e9240efadcb25e7a3a1f6f85ae6f88663807ff92
SHA512 79eff227a57c959da87b2cbf99122aba5d73eba3ca2335f9db63f22fcd7ad1ce6076da5f3902a972b5d3f7d1f05e4a6d863abda83f41299c48feb71da39570e6
SSDEEP 12288:JEP3Rner3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:aner3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T185E4126D6BAC60E9D07A913DC4918244E373F0B12B0257EF16A0C67E4F779E96E3DA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 be86495953865560953ba08f5157d7ddd3cc92b2e31ae3f091dfd78665748a2d
MD5 d3601125cd0fc9a5634dbd3ee2329207
SHA1 5446479c5a608ecf26f38fae67826039b9c4627b
SHA512 d03a52ad7b761d212268d0e3d819b9b1b082fd690589ae8474d180d5f010bab923c865c9d530dd7352b6cc23e987f025c12d529f18928b41728f64a30f561c3b
SSDEEP 12288:sjkyzr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:sIyzr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T161F41200A3A850D5D5FA4638C96392D0EE36BCB06F0187DF5590EB2E2F77BD4A935B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 3dbc02dc0ab5d25be8aae490ecd499a6d1815d7f32bd1db63c0989b96d4b7bbd
MD5 a5c4478996e31f90900abeba4a4fb798
SHA1 302bcdc67f84ab3b1c32c4364a53650e6ae7c318
SHA512 707c02c3bd99d5897142f82b9f4fa1a1a00ce8acf1db646916c6d4a8565f06c4b45ccbde2c0da0295b75c549b16d9d33216733e3c9e0d3dba98ce6b962935a03
SSDEEP 12288:Ryxr3T6di7aQbyhnjg9nHMCeKL573mBxpKGNRiMFSQaVB7l:Axr3FaQ+14HMCeKFmHpKGNoSSVD
TLSH
T13ED42304B6BD50EAD8F78678C866A2C0F65778F12F054AEB19608F924FF79D4B1369C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9d546c5f99daed615f0c2e04dd61b7fca4b408ec1a6aff80a728a359717b56ea
MD5 06be1541be23bb368f86f87de6254723
SHA1 0c1e1b4dc03067382fbb9f06c122bc95b9edb60c
SHA512 968a763668461392912293a89dfda4c1a82af1e4ce72b3771ce40ce6174a38b1ef643365bd4ca9bdfffa1bb91a4d6782c312db2fb89c67fb652306bf0318008c
SSDEEP 24576:DQ9MxZKdcz9dw3Ur3FaQ+14HMCeKFmHpKGNoSSVD:DVKZUr3FaHCbmHp1NU
TLSH
T141557C2DABE905DAE177D23594A250C3A673B4311B31C6CF2448D13D4DBBEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 206101c98e0685eb7ad61efe2cf0d8e638637d5078745a92a651e73f2462069a
MD5 b3f91ddc5d46073ba4fad4275159f660
SHA1 d79ca0f88f2017f8a3966a16ed4a3df61b5b080d
SHA512 e72e268816f9edacec74324fb58f319786f1e8104c3984cd2ea189bfda40fbcc28c3acfa8d02025b6557a3625aa3ad08bcf18eebae506d3814dfc8ccb7f287ba
SSDEEP 24576:ayocDAprr3FaQ+14HMCeKFmHpKGNoSSVD:nocDAprr3FaHCbmHp1NU
TLSH
T1E7F4E01FBBAD40E2E076813C89858284E773B0701B5257CB6691C73E4F67AE9BD39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7838c63722c27d0d14eac526b9c0e8b7aa5a7ff0c703b6a0e733afcced493767
MD5 2573d4e418513663d6abf3f141d397b8
SHA1 98f09724f6baaffae6061d75ca027356413a56d8
SHA512 47ca0360c31524641a5bc53967061d435fc4f7b726d276e67411d16c1939d8e139c8b00b67a894cbe5b598a4daac1835bd15aadd9b74936bd60e92211d5d3df4
SSDEEP 49152:6WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKrr3FaHCbmHp1NU:80zuNIN3F3sHNU
TLSH
T1BFA57B3DA2BC00A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a6d71efdb888b5818fe8ce201eee2cf11adafe432f7b863228ab2462d195c9da
MD5 812eb13a45d9ef8e2dfa83e4b3cdf5a8
SHA1 90d5677729cc61e850e07b045c77c4c37fe93474
SHA512 4c8935fcac5c32622fe94f6e5bf9d861175df70b4ba58ac16c7b6395de45cba8dda6c93d83479655b86afd0c0e679c95575cfb7b817fa77a6a7c37abaac32259
SSDEEP 24576:k1QT7EcpfxR+N5AWAz3ooiYtjMqber3FaQ+14HMCeKFmHpKGNoSSVD:ZTDxR+N5YzTfjM5r3FaHCbmHp1NU
TLSH
T10655B02EA7F815E9D1BEC5798A23C502FA727861073193CB4260C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 7375fd1e2da49b3f934a5a69acbdace982bb9f4c2c4c2524fda49efdc11d7497
MD5 a44e87717ced100127c97690ebcc7c77
SHA1 db4fbd848659b5a4b89d1b7a84daf180194fd7ac
SHA512 6648d14732d1a0fd0f67bde3fc6a3e42cce455a2be243b7ee141a9ba5626376c1ca92fa0cad365905bad0c0e801e720595d570b70475beee827852b39adf0546
SSDEEP 24576:Q3YgnJcRTk4yti+R5dBR/7r3FaQ+14HMCeKFmHpKGNoSSVD:QIgnaTk46pBR/7r3FaHCbmHp1NU
TLSH
T14545AF2DF2B910F9D8A6D136850147B5FB71782D1F209ACB0170C638AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-76-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/216-173-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/216-82-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/820-305-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/820-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1236-249-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/1236-312-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1236-255-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/1236-248-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1244-279-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1244-280-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1244-286-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1244-402-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1388-407-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1388-302-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1732-239-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1732-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2124-52-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2124-32-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2124-38-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2256-269-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2256-320-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2392-317-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2392-492-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2536-326-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2536-403-0x000000000C330000-0x000000000C338000-memory.dmp

Download

memory/2536-381-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2536-397-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2536-365-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2536-497-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2856-468-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2856-309-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3000-261-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/3000-259-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3000-316-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3000-265-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/3128-16-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3128-25-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3128-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3168-298-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3168-292-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3168-291-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3168-405-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3408-438-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-436-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-424-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-425-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-426-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-427-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-428-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-429-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-430-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-431-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-432-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-433-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-434-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-435-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-437-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-439-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-440-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-441-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-442-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-408-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-423-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-422-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-421-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-420-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-419-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-418-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-417-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-416-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-415-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-414-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-413-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-412-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-411-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-410-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-409-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-447-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-446-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-445-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-444-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3408-443-0x000002CF2A3B0000-0x000002CF2A3C0000-memory.dmp

Download

memory/3684-54-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3684-60-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3684-66-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3684-63-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3920-399-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3920-276-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3948-0-0x0000000140000000-0x0000000140119000-memory.dmp

Download

memory/3948-73-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3948-72-0x0000000140000000-0x0000000140119000-memory.dmp

Download

memory/3948-7-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3948-2-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4208-493-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4208-323-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4216-175-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4452-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4452-406-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4452-272-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4792-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4792-171-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4792-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4804-313-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4804-491-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5020-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5020-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download