2bb432773c156fd9a0c95d17e80305091693fffb296251d319b317bb93e24356

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
Size 1.8MB
Sample260816-m16sdshq21
SHA256 2bb432773c156fd9a0c95d17e80305091693fffb296251d319b317bb93e24356
MD5 59d8970f8a5037eab4cd05197484f76c
SHA1 cb1614e667161c43ae000cd4c45fc549a21cfd60
SHA512 53247781ccf60a216800e5dd5baf99daaa7aef21c59d3bd6db81d3a8b2e021398a5d1b506c8d1f716ae2c1c0d039566230f38341a60de3e747bc96cd4021189a
SSDEEP 49152:9t5JunAuE9CD5yaOlllljC4gMwFf404/+NN:9t5knAuEodYUFfZNN
TLSH
T1689517036B419C2EEA6112394C6FFD3042986D7B4B21499B72C4FF183DF89F5792BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1976	alg.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
1056	fxssvc.exe
4056	elevation_service.exe
1828	elevation_service.exe
2288	maintenanceservice.exe
5108	msdtc.exe
4152	OSE.EXE
2704	PerceptionSimulationService.exe
2668	perfhost.exe
4656	locator.exe
436	SensorDataService.exe
4736	snmptrap.exe
1100	spectrum.exe
5060	ssh-agent.exe
1544	TieringEngineService.exe
3548	AgentService.exe
3892	vds.exe
4840	vssvc.exe
2424	wbengine.exe
3252	WmiApSrv.exe
3404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3949c80d79c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083b543056e2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000609882046e2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef1b08056e2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac2659fd6d2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f91746056e2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f2ffc046e2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000263b4dfd6d2ddd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4056	elevation_service.exe
4056	elevation_service.exe
4056	elevation_service.exe
4056	elevation_service.exe
4056	elevation_service.exe
4056	elevation_service.exe
4056	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5052	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
Token: SeAuditPrivilege	1056	fxssvc.exe
Token: SeRestorePrivilege	1544	TieringEngineService.exe
Token: SeManageVolumePrivilege	1544	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3548	AgentService.exe
Token: SeBackupPrivilege	4840	vssvc.exe
Token: SeRestorePrivilege	4840	vssvc.exe
Token: SeAuditPrivilege	4840	vssvc.exe
Token: SeBackupPrivilege	2424	wbengine.exe
Token: SeRestorePrivilege	2424	wbengine.exe
Token: SeSecurityPrivilege	2424	wbengine.exe
Token: 33	3404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3404	SearchIndexer.exe
Token: SeDebugPrivilege	4260	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4056	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1108	3404	SearchIndexer.exe	110
PID 3404 wrote to memory of 1900	3404	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1976

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3148

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:436

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1100

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4320

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1108
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5511f12cedfc8e9b7f644f05cb4670dbd14ea30e2ce280cc25909d388f1ed2b3
MD5 3c70e81474803cbbf14afe493400b5ca
SHA1 e403559a86889aa07255a1a6ae7bc983be3ff3d1
SHA512 9aed80827cb938dcd107225f037d081568cd38ca1eb6981c34905797943768ae210c3d09eb9c096f33ad418decf12f30e931fe15deb9443a5a0bde8ec5c0c131
SSDEEP 49152:fb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn7MwFf404/+NN:d3q6tjBgFfZNN
TLSH
T128D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a8fbac108fc6d0f025775191ffb0fa07b0b2155231070c48970790501e2ba73b
MD5 7903d1e20d83e98531b13184e1fdbbb2
SHA1 96fe082fc1d48b3e18861e72e0fcf062906a0981
SHA512 3bf316f8d369be2f2f1363efa502e7a2cc809d15f9d780f9314dfe6987c7a92d67ddbfecc77823e9c5bb5f6c7dc638307c794649832ffbf471b998fe9ba179c4
SSDEEP 24576:BXYfDtczAUXUxw7FLf404cFVQj0N0xAJ3PNN:EtcxMwFf404/+NN
TLSH
T16F75012977E448F9ED67823CC9A28911EA337C4547A0EB9F03E499254F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f9126a5cd0fdab0d3f7b1cebb14e4880da00407de7765b6310447f20ae58a59d
MD5 da739ab6e7b71d0661280e8936d56c9e
SHA1 94c2c37793c35cf9c3f601c32861cd0f9821cd4e
SHA512 df4ece9141f10da9fa3ddb2cf536d5d047fd87cbb97f96bf19ad524a1c31d01f7c39b3fd52e1523d556e9ce3777121d110a4ba5af497f920e7ba3fdaa4c164ed
SSDEEP 24576:i0Le5ji0hmxnrMrXUxw7FLf404cFVQj0N0xAJ3PNN:iPji0Ax+MwFf404/+NN
TLSH
T1F885AF16F5B48371D073C0B9C5D2A69EED7230861B3089CB4286D77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e1454abd0670a4ee7a57e10c2a19bafe1330fc7aa986e54df32569f2c0459c4c
MD5 fb061b848ea2b614a3fe3b01a49b824e
SHA1 16c43a471b1a6670b20eaee8db016c7b5e825f3f
SHA512 26af7bbdd34c560f8cf55c6e59d634de1c87d3aa604bf71d9e4f3bd78511ff1ad375eed3abd3f8c15ad8280ade0df6a8276b5899e52a70e1aa4aab08e0a47529
SSDEEP 24576:Ra7/ezSC6vUyDZaqgrvWx6q8wyu9XUxw7FLf404cFVQj0N0xAJ3PNN:Q/ezSC6vURPvMHjy6MwFf404/+NN
TLSH
T172756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 baf1d3d68d45fec310df7f58de919e80a95bfe3cd3281586c2caa2de475899b3
MD5 d7ba7f5ca123dbdc35f4347226f035c8
SHA1 1aacc02ba4950f79827d15ef77ac268967bbbc1a
SHA512 38c454b182db40283e2c782a8d0487209e21b719e0f78ae63cf6c3ffb4c2c4e75c802aac061675f6059acc36130455b840d848faf30c7b7919088d1811def9df
SSDEEP 24576:RVbqPb88hv/lV7QXUxw7FLf404cFVQj0N0xAJ3PNN:RVO88hXlVEMwFf404/+NN
TLSH
T14F559F66F5B4C331D073C0BAC5D3AA9AEE3234415B318ACB0246D76C2E676D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a4e4b3cd50d9006a24dad59177f27697c1646902b08624e7cfdc57bfc8d4dd48
MD5 74f3c4c4c25943a79cc8722469017328
SHA1 2153075677bcc5ac9d349bf1df082d13df3a225c
SHA512 bd32cfadabf909d56ec4acb653aa9c5bd96977943771a59e072d0f14629d0ef1302d468935c02e156cbbf99017e0a506d9621c92e838242abb89971a8c3e4516
SSDEEP 12288:lGnNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:lGnXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T18F55239369E9F4C2EB60133DFBC3AE3845322D481CD90C2F43A5BA9ACD39861DC6D419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 05f0d3da8a497586634b6abe5b218e51c4c1e08770995f76ea4f9de69bcb9108
MD5 a7954c28da3d895b542108da41d4dd90
SHA1 5f51550d7249ed4d19520fb50d43f12046e5d8f8
SHA512 9846fd81a884c232e4fd03eb8d4293454cc46856e45ee8f80df3b76b32d60113f1667fad3876f389dd42202f99bd74a90feb5afcf69101ee40239f6c493190e1
SSDEEP 12288:ueBNUbTVO86U4NNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:uJIU4XUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T16E75CF7BEE68FCD2C27A49B85B918600D77278704F6293CBD165C20ECE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6c38faa41c914e2051cc74a4f53d85973171acdad4c365654a5fcb777aaf9379
MD5 1463cb19dd1b4cffa4170e4df9a280f1
SHA1 de19b7c81b99b820ea885aba9d88e4692e946533
SHA512 8c0deecfcbd9903f7d972b9840e3733d54c4b79748ab7026c2da4599e6e937dea943587849b7a35f0ddefa516c8b96c00161989716c6f04e11e23915a280064a
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THU:EQvGAdlCEL8c/pRNw5CrFfZNN
TLSH
T16B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 250f950ae297b944e70f4895b894e009586462708e9c05fce29adccdfc5120a8
MD5 522449c4559190702f9e6f960eec6856
SHA1 9278da0c0c7ed9b1447fa3e3e9e2a34f44bec504
SHA512 c92180a30798842d138d55f34eb2625d865c4dd6fbf3a00454d6ea6c0e2cd2a47aadced85ba48e8c54e8000480366208dac9eb333f58cf8e52c51af0661ba31c
SSDEEP 24576:GwewsAjSXUxw7FLf404cFVQj0N0xAJ3PNN:fljuMwFf404/+NN
TLSH
T1C275E031FEB4E032C77B0DB61B66C716543D79204B9119C3E3E89E9E89341D2277AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cbf1e83e28776b733bc4e686319d1c79621c65816d42e8087cde65742ce8c0fe
MD5 41fa3301ff592526046dc47bcc054a4c
SHA1 a896b58f597df1e75388da85ca23731bec0bdd61
SHA512 ba4c78565e79c73a24aea7f9ab8227ec12aefed90c5bc5e4347ae415c3afe4be30a6ce68f3ad3cca91c20f7852e45ac1440b852112aed56152ad2a9fee3f3777
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHyR:pUEtQevvqc2W1cpV29I32
TLSH
T197474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 236a6af97e815732cf24b02a379f473b748858a05e762c4db4445d872355d875
MD5 ce3d245d15e6c6356257ec35887643c5
SHA1 612ef7e1cb44786ea686928f792e680f4119b968
SHA512 cf1886238c2ee11d2f779ec793efaecf7751570b6b58893891048e380ed646a53e725b26779acf8350c0045f81f7365aa12b7081633a3078e41bd61a9afe7eac
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zOMwFf404/+NN:moqtVjnmfFfZNN
TLSH
T114D58D0976B8C1E4D1F6C37896A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1bc87e1afe496c6fcbf652032712fe21daae28ebb1c2e4eeca4c7c068c982b9a
MD5 f2d1057aed2022e84ee7202443cc04a6
SHA1 93839c33d525acbfb2544a4e43d97f0e0c6dbe10
SHA512 c5cec38ddec1e1c5a0ad5cadde8debc5966c72fc845034570a1ee0d3aa9f6202c3c3684e44105b6e29f8a14cde8237c4049b360a3becfea4f0d354ea41ef317b
SSDEEP 24576:8AhGLmIFoiwtA5l7S53xXUxw7FLf404cFVQj0N0xAJ3PNN:8AM1Foiq59MwFf404/+NN
TLSH
T106359D81E7F955D4F5B3AA7899B68570EA76BCAA5E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b15ab231d7ec4bf19252efbfe7d59639d1dfcf5ecdbba3822b77f6a708e82cae
MD5 92d2ddba3455c2212615e29d6c99398a
SHA1 e1ff73d333c3cc67c6bb9002b9243e86846eb6ac
SHA512 f457609eb853027afcb98b6ac7bbe4b892180780b25e26d23006a2e8c3586691c0b4fdd305e6dc9fe8dd138613a29d654910091bdfbc0996f4cf0276f08b254b
SSDEEP 24576:GwuXOWWXUxw7FLf404cFVQj0N0xAJ3PNN:GwQOZMwFf404/+NN
TLSH
T12465F14676E85CF9EA674238C697C535F7B2BC012A65CB1F0360C65B9F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 25b934b52e0a4d361ec8637563b91898d4fa10a210bc8151250c9c5d95c59b6e
MD5 3e2dfd80645e54ce95d863b353ef7814
SHA1 d3504b174211fb9d41a090d237d89b7b7e7772d1
SHA512 48c2321d366ecc42120810496b8c1632367a81bbaecd1f1a9cecb49bea21d3afa9d9a4a3c4b5e0582370f0398a5e8e5c221407829a0843c83fad6e6a1765fc8a
SSDEEP 12288:ubZ1IyCNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:uZuTXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T16655129A32E8B0F5E2A2033CDAE25A14D7723C4627B647CF0365966A8F339D15D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d765865c8ac463a7107a9ab231693598eb5136d1658736dbcc2c07d22b9127bf
MD5 49921f3cbb22c5d54a97424a5cd13c5a
SHA1 bd01173a2370f4eaa579aef8b2aafdd0d0d61458
SHA512 2bb5126d680e49885fca54f26befca7df650a9efb3b03e059e9a0c197338eeda1200f62e7e75ab92da798fa3350398c5227adfc328dafc3e196a495678658c3a
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U4:lQRQyi36YOcPuLvw2gAf+PN38FfZNN
TLSH
T1F1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c2998e7b8ff291818f0146429a159a2048f6d835737045354ebdbda1e0a64202
MD5 e91ac5a70ee9e516aec38ac756750ac0
SHA1 8c1799754d3c031e775901ee0725660fc6c38534
SHA512 956264829a0e000e1baa4a083bede8eb2f4ce4b0a687fc624e7c085a188bb5c461fa77ffd21658ca4542adf95f914e5840a140e2ffed1e6ba109bc3b26025fe2
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U4:kQRQyi36YOcPuLvw2gAf+PN38FfZNN
TLSH
T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9a21983ff982ba288364a7e79cd1f2b88cca4c598aeaf09b4eadec002df0e31d
MD5 b689b879da7def84b114d95b71dda81c
SHA1 0f21ef640f27a6f318ded6b77e71c0825facc295
SHA512 5738f34052edc2054a7bc2f5ef35f4714094c7db3a63c6f9ca2069fbeb044b3fbbdb977485ad982628138f463440e05710e0e77ce22aa5d93952c0691f556f1d
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0jXUxw7FLf404cF/:A68Qg55nhxeWu7PNU3/+MwFf404/+NN
TLSH
T16AB54933B2F60099C44DE1769F46873196E27C758FE1E7DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 369648ced579b4291cb736b9e1ef9f0eeee1d13cc442516b9703c6cc24d50259
MD5 d900e8fa94591c78b2feadb19ce6a8dc
SHA1 20a3bd17697481f37a190b7986a77812a7e51730
SHA512 2391a6c2470fa9d03f50b8bcf45d00bd159aa24a8b11aa24952325f80a4dd4f7bae2414b40f4b6de99e69b8b27a18398bde6e160d225f7eeba314fee3533fe39
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:My5112gYy5azzVvD69nLKnhZdFfZNN
TLSH
T159168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bae42246eab97518ab389cf6035a9c1fa5aa66bba5bb49471d5b768b953e5a04
MD5 e84a8669bd9b4aa18c7e8f507b82f1e0
SHA1 410af3a9ad577f927ceb3f38c2cdc2c867519eae
SHA512 3201b95e7f73cda47d35bc8d5eb665fc76edb2917789253eac57738027c0af1dd870dd8d0b403f73845d0cb2f631689f29e73ab2f7604779fd893c0b9779c1b5
SSDEEP 49152:cB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glMMwFf404/+NN:2u6JmQxd2d0FfZNN
TLSH
T118D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 87b7452916b14a59695720549a8a829bb544bdb394778e85dcfe59360bd0c138
MD5 02f317dddaa10cc1654191b9bdde894b
SHA1 2113fa7e7df8a15a0ea2fe3425b5249b1799f893
SHA512 8a1b0fc340d5f4933fa39893a6eb6668e9c1f26319186f6983b1ebf6dc81e09c80e3c93c35b9a58dc0442c0f08b93fdb3f2bec390031579446e1511dae302791
SSDEEP 49152:F1hpsNoJpF1A6yU44CwH7R4xIMwFf404/+NN:FmifPVRfFfZNN
TLSH
T1D6B5BD13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d62d831b223797bd0afd6c4fa974aae215289e8a7cb252372bb8a90252ac5854
MD5 8c4fe9d42f9751e112a7bc3290c3a651
SHA1 0fc5d8a789cad2f41015ef6f43c7f3ff624df299
SHA512 23c1a687ff19d268764d816bd4fc2063de294abfb19ec2e5c9dd23c9f011b5ccb863c5ca0110cd6ccea4f40adc38d720f6f9256d6b5b776f98f76ec892f3b458
SSDEEP 49152:ESuZQIY0Be2KIRVtOnks6NMHqrMwFf404/+NN:W5dKOi61pFfZNN
TLSH
T146C5BF03F2E940E8E0BED67887669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b64ca493f7220376c44fbb3f7cfa27a68efcc59f57aa9310c6c8ab66de52f6e1
MD5 d83a59ac8e7a9824bfe14b9d6d346b4b
SHA1 1a041bf1a58930a023ead2344f903af217362a12
SHA512 a2eb10e8b818103643c9388eb017ee400830c65282ffce1969d9a8f34334266ec54ebf1b317b8d7bd96f2afed35215f2c60b2d8cf2d6fc6a4e7f5baaebd0f251
SSDEEP 49152:khtSn8EApI0figGgiDn0AP5w8MwFf404/+NN:lX2i/phzFfZNN
TLSH
T13495BE13F2D940E8D05ED178C7468632EA62BC050B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 24d36eedd54231a6666e7eb3c4ac80bfc613da202c3c225f689e62981141388a
MD5 eb7c04a3ede739044cd7e415e4aa8647
SHA1 5a1b7ce9652485ede5abc8c5bcbcb75e9499d495
SHA512 3a010deafcaa117452f39b5d03f00469dc04cbdd1538923415f88da6f707bc774ecdef631240edddbf703d531c952358f0543c996c64e5ced8c572eaa2ff0a57
SSDEEP 12288:jPNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:jPXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1BB55238778EAE4C2E710137DFBC39E3895323D896CD6082F539AB915CE7A8615C6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ad491c74f83a56793af5f04043ba99792bddfa0c799342cb527dfbc1afe7a6f7
MD5 0eec034102b9d053b8d0e8f96078088a
SHA1 1d7107a6e84fd81d5751ada7ec4dfc909e742afa
SHA512 7591f63fd27d3aecdeb3cdda50d5433396e99a5f99ad39a783f687750edbc8cb2e45aeb8204c4a3cec1e3a07c5dd9b7879ac7ca3b544ef1a55ee7b766bff7062
SSDEEP 12288:kONNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:kOXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T19055239778EAE4C2D710137DFBC39E3895313D4A2CD6082F539AB915CE7A8616C6D82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 32352c80399222eceab386d0de91506a397148acf63cdeeb152bc7f18f37cdeb
MD5 8cb3d62c406821a630ab20f423c7a15e
SHA1 ee91c5e4411b7bcb3da85cc3544998f0469ce9e2
SHA512 c0a59a5ab59411270335b9d9805accc15ea0bc3ace6c185f6855902f13cb0d554366b9d8b26a11f90ce76a7b3c2eaed145a8429336494eb1e97145051eb9641c
SSDEEP 12288:5gNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:5gXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T19E55239778EAE4C2D710137DFBC39E3895313D4A2CD6082F539AB915CE7A8615C6D42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e12b1b82f3395919933a6d06146863005dd74341925389a386738e0df2c5c544
MD5 446b51563d78df8412f2c44eb8790d5b
SHA1 62f7658996f53bcccab29ea0b51288e69f94d2ac
SHA512 5f350908c947f3dd9c535abb6b623c0b949c89e28640e0c249b780601d2f2e3f1166ec8bd1b2dbe4f1b40e99167152e7224b133b6035d51003626a438b5f8b0c
SSDEEP 12288:cVRNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:0XUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T18055238339FED0C2DA60533CEAD39934D2727C8969F6092F5351794ACF765906C3CA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 473aea32363198ae94eea7dbbac67b07913394944501f09b12b4df8dbf057016
MD5 413e8de82ccb996b35a7e165f751455a
SHA1 8ace64c28bfa7e4ee9a17a5f808c8628c65f1afe
SHA512 9bbb952d323bc0279560845a82ec7b7b50ef3c3bd96959a92908ad1d8905c426f3e3e19d232ecbbe3c2be808f30d4d6aad69a0f7a661369668f0226d18009e6c
SSDEEP 12288:JpNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:JpXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T10755239778EAE4C2D710137DFBC39E3895323D4A2CD6082F539AB915CE7A8616C6D42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 236865688827bc983ba0d9d7e5e62afa4b81ac5d8fe66227f6e5d939468c13cf
MD5 c96931f026c51932f228796b38a71301
SHA1 7d7cc31b2cb1f3a0a1ac9d74f43e344afbe62450
SHA512 ca6b2bfd3c3868beff10eb7e71d3f45d265a4b6979199bcce753abe200d1c2db6c16360cb1b24d77adcd1077b790bb94aac5b1ab8ea850596626b123647f8b92
SSDEEP 12288:w6NNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:w6XUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1AE55239778EAE4C2D710137DFBC39E3895323D4E2CD6082F539AB915CA7A8615C6D82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 803c98b067d72c4d066a21a933e5147577047d115c213d24fa9c16445249e1e8
MD5 462c1f1db89def76b6e14e4a849279ad
SHA1 0b44a0e231eaa2559a70f18687250bcc8e8a57cd
SHA512 8eecf463717f8a3910a8ee550fdcee977d2c98361f3062091b5660db2f2b87eb53f36e90227b0e3e59e729929506595c73ee0074709df9421426bde49a323bf6
SSDEEP 12288:ImNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:ImXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T19F55239778EAE4C2D710037DFBC29E3885323D4D6CD6082F539AF955CA7A8616C6D82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 fc4aa5b9c4e337a26dc82c833167cc8dca034eb1a86f1943cf20a16c23ac29cb
MD5 2e3fdc29c01543260827677232c7a118
SHA1 525954e4072b284d0eb914c7cd79fce8266ac871
SHA512 cd1bdd5ad0ec56afdb30f822b142bbd0f2408aec8759e2cee3879a9e93e44447bdba6a70a54510944af7c30ad69ad4ea07981020cf84e7cb6702c90df245c185
SSDEEP 24576:AZMJzFVSOuXUxw7FLf404cFVQj0N0xAJ3PNN:AZMJzf2MwFf404/+NN
TLSH
T133750195B3A058F4ED67423ECD568915D6B27C5A0AB0CA1F03E4366B4F333A11C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9a33cbfbe221ad24a709ab9c5a1986a496c0d041e899d5a3d51f9bf123ebc8b7
MD5 bf2dfab0abc718878c134119f17894e3
SHA1 06116628508b078b84d816a788c94c2b42a41578
SHA512 d9158f36505246869eb76d0e140e9baff441f369c42d5d30e5a51961ba7de14db462db4f20af3bf33bfe259616fa2041dba9509e361bf5cd79527e3c5077cef6
SSDEEP 12288:7DNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:7DXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T19255239778EAE4C2D710037DFBC39E3885352D4E2CD6082F539AB919CE7A8615D6D42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b798f5bfbb73acaf53710785a83709c883844e2538a8684383bfeb084c5ee293
MD5 00498905aad54a9617ffb6120fc5c11b
SHA1 74dbb70c598901a4e7ddf0c9503ebfe9fd934b44
SHA512 e86ffb561ea7adb6a0f4b07cf61e48cfbf7c29c06814d2da216733cd35a1de2931e4a3fa76036a99078273f42ca9510d9c0775ec94dbcc35ac68f6517871c0c8
SSDEEP 12288:gXNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:gXXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1B655239778EAE4C2E710037DFBC29E3885353D4E6CD6082F539AB919CE7A8615C6D42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8f5fa5cb0544844dc485faf75911992bc598a519fa8b9a17959a7c950da1da5b
MD5 49d97f6e21ddae236fd7c39233d20d0e
SHA1 a859c19e60dc519d64f096b1b425ea168e2368de
SHA512 83326951593892adbcc8e38c80b2d94ca7af353db103685444d2c8953b1b6bb8e8d0c34a506e8ba75d3895f8e8c405c49344fcbc8039e5047c683b5a167ebe40
SSDEEP 12288:ZyPz5L8CNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:YzyCXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T15B65024776E570F9D2364238C9921A11F7727C360BA18E6F13A4577A4F376A09D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 36cfa8635e23cc64fc3e558325480790372615f6c980f010877bd78d48e8523e
MD5 0bc7d72990f32d2474e257be4b929ae0
SHA1 aa6533544695e5071ecd64806790c8eb279633a9
SHA512 7469aee85c8825d2fed6a6b3ffda53052c3780304b7504a35cb19d7f824904d0add4fcf71de2ff61fbd469be78f9c49bb46a77458a41c0224a2ed1f1be49fd00
SSDEEP 12288:PDNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:PDXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T14855239778EAE4C2E710037DFBC39E3885353D4E28D6082F939AB959CE7A8515C6D42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 653f7b5d2b3d3b42ff48335848bfbd990142220ba73ff9bd1f89df0ec33546f9
MD5 08960ecaa6e35f4d9ef4996209ef9ece
SHA1 837e10959094de520ca14144408234bef428e0dc
SHA512 66a0e55f572df140bcd2051b227bdf108d9bbf29d4dc37d13e5b054e1028f117c9f5d9eddad1de12f459be78d26a1e3c3bc3981551f3d6fc157b805ce8eb6693
SSDEEP 12288:LDNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:LDXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T10655239778EAE4C2D710037DFBC39E3885353D4E28D6082F939AB959CE7A8615C6D42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 58c397afd873abc5f8ae7ba0d4c223801fc22f7ee7d9e868d7e3dcad16918855
MD5 05ca0e89ce6b1292b4b18004b5733ec0
SHA1 66c17b38b0c33191f65fc23c8d8a57cf8bb6f26e
SHA512 c7188775be4e974352c56ffeb95b013849d6428cb55c812707ead325e3d4cd289fd2c7345e22ed6b2f75186db4f02c8467aa8dccf4b5f1c4e7d1200dcd2aff79
SSDEEP 12288:ByPz5L8CNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:QzyCXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T16865024776E570F9D2364238C9921A11F7727C360BA18E6F13A4577A4F376A09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e0830bbad6eb0022a3aee16bc5376395be59fd50fdd87df3b2266369d1f44696
MD5 442637b36d80d3bc733fe5f0d579552a
SHA1 b118be3533c22856a86ff5f72e77e4c27e2b9073
SHA512 9d60b973e279fe03166384af75d5ecd16a76bebb703daf7dff3f13bda9ff5edb368d1e3c4b6e9641aa13e8d0d24cc641b0e69887a2af6b58ea7626e447b9a9ee
SSDEEP 24576:ScP4mcvIjkGOxhKP2l71nNKbrh/8KB7XUxw7FLf404cFVQj0N0xAJ3PNN:dP4m4IpOO67W8KRMwFf404/+NN
TLSH
T1AB65BE2DABDC0096D0BA913886658A49FAB1742E1F3286CF1160933D6F77EE14F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 67ae833bca4bc93922df7abe5196264708a75846d2af7c79bdf96dbb9c2c67a6
MD5 77a921844f2df5a95edd023ff179b6d8
SHA1 07155380b1f52f34a02a253e48f42586c864596b
SHA512 2f1e3469136430afd6921c3dd64ef70e615ed3aaaece0785069805e3fcf10f127bed1acf8c7088329497d2389c8bd8d091cce4a2d0bfae48c17a68e4c45d1abc
SSDEEP 12288:ZksfTNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:pTXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T11C65F15AE2A851D5C16E6239DB828A10F3333C5597E187CF53D0F93E0F3A5909DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f43fbbf7cb7d25229cd61d05819ae8c3fd0b12bf08d439c2c38115d3f8ac0a6c
MD5 485208199b7e0118b58a0669746f05da
SHA1 a74152e4e6ad7fab60dedc47cdcd1360067e2e1f
SHA512 1edacaa457d9f68c3944e2664b36cc1afe3f318eca904ceaaa9a27f2899d4cf247b5c0d1819800dd9a3920fead2c09ef97b1ba162b177280319a6739e2f2e32a
SSDEEP 12288:AzNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:AzXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T13E552393A9EDE4C2E7701338FAC3DA38513A3E481DD5482FA385B659CE398A19C3D51D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7c2db5cbff800cc16c8670876cd4b5e12af3cd6a073e1766ddf694fb65854a5e
MD5 2a236eea2068792aec7d3da67d915d78
SHA1 607b70ce5fd5ebcdc3db7da8c2c1389ae5ce3e39
SHA512 011e2a027d953e6dcd02ee080a4dd97ed44cfc48356043e2d846e0b76099fdcecf8a75f957308d7eee75e568364f975b3a64a715fed34e3e4f35ffd4b46e2c6b
SSDEEP 49152:/a0h2GEkuAe73q3pp46zwwQVMwFf404/+NN:/a0hNYG4JwyFfZNN
TLSH
T1F085AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 3a1ceeda22e7f41380994e53b3656d9df551fd4ffcb96a410b377109157b5ecb
MD5 97f1e4028adcc13991f319cc2d644115
SHA1 a7f15eb6804712ba4d91e132ad9f408a3ea8ec50
SHA512 df9c0b5a5676a5493045c4ec0fe09474c8654c35236c2cc248ac72800f0c78911e48d4b66a774ed86cb47ed7528cee1f8a81d582b0d21701ad34ab748dee9b7a
SSDEEP 24576:IhbHjPeXUxw7FLf404cFVQj0N0xAJ3PNN:IhbHjqMwFf404/+NN
TLSH
T17B5502BE26EC20C5E671A27D96828A09C331BC191B5247EF13D1927E8F3BDE05C39E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7c3ee173a4f0048b75630f243766a104d8c33b5041d08c2670190e8595ca0126
MD5 42893dbac78555639d18ff9679deec71
SHA1 3eb319e25c6fdf1341f5f6056bc4e007ea463041
SHA512 ed7c61963cce37d4da72a0f57883b9cf9cc91d86b8408a8b315cadd2e523929ef4d6443cf3b79f4616875953bcf3baa97e5e9ce04292061ec2f9567e62898716
SSDEEP 24576:V3YgnJcRTk4yti+R5dBR/WXUxw7FLf404cFVQj0N0xAJ3PNN:VIgnaTk46pBR/aMwFf404/+NN
TLSH
T18245BF2EF2B910B9D8A6D236450147B5FB71782D1F209ACB0170C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 dd2f7aaf713e86bb3b408316a55ebaf31c420bb5dd2726d182f484ac66525fc9
MD5 6bdf0cc22eaa38519be1e6d6c43eff1b
SHA1 77afb1ef40f6bd0b95e6a0f0b10c2586c8ebff40
SHA512 b5a640dabf9f8328cf7591d5f083d81161f45bde700d62b188e863b7215e50265a02ffd9e225c2397d9ba3fccac59fa8bb8a39e7f9b54b316730c817d9f24ced
SSDEEP 12288:yHNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:yHXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T11A55238674EAE4C2DB20137CFBC39E3855313E481ED60D6F529AF959CA3A8E15C7D418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 df94e98dcd19924ce33fe1cc3becbcb735d48f6003e5935d3e60d5606361fb96
MD5 fbe0569e77c1f1b03ca637566cc94d85
SHA1 286b284950b7a124fdd432e3269bde38ba2b65ca
SHA512 bef4a62ad0377d463eb2377f5223b1367898cc7b1a60ee085a8f02e9a9e80a1d7e44d27f375d1762c5bf36966549e4705b3feb4456fa7851283c03ff0a9dcf64
SSDEEP 24576:CtL3UTUXUxw7FLf404cFVQj0N0xAJ3PNN:CtL3UoMwFf404/+NN
TLSH
T136750155F7E540F5E977823CC9A28A26D272785D07A4E7DF03A88B650F236E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 e347f905fb582f7585c50ee4dd78debfe9b2d6fa146c21a9180d3205146a83f8
MD5 316e5d84b29cb9f68451650da503924b
SHA1 8d627662660709e38c0dda75ce00d096c8047412
SHA512 3cef98c33ec8d57234949cfd5131f383cc0beb390323f7c1267554b34a611d6893d0c2e1180021f256200c803676e4a782914738b10ceeed8c82f479984d605f
SSDEEP 12288:opFtUOYNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:rOYXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T15055025A36ED20D5E635623C9A83861CD37278560B6207EF02D0917E8F77EF46C3EA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d4008154c077ab65c58a2c1179a64f741bf19e7f0fc62eb41131019c63f13ed4
MD5 588e24f0f00114efd7062e2c8a14a1fb
SHA1 ba69709c788c373240a763b2fe3baef8d811cb66
SHA512 a952c7299bae0ceba1cf9831e0893dc485c6c6cfab643f4e03482e0f61bbab7daae1e26cfa861ddea0bff83f05ba9b9efa1be6f10a4154914cae348e77b2198b
SSDEEP 24576:Z7NM9YqZqmWMUkPjZM48Mv6bEhsDXUxw7FLf404cFVQj0N0xAJ3PNN:Z7cBWMpPjN8DbEhyMwFf404/+NN
TLSH
T16B65AE2E6BEC81D5D576D13DC9E28605F2B2B4611B318ACF1162833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 35c9b140334ca885694f380340d58823b74b0472c51b67db547c863860190d94
MD5 aa35057faa9ed101cc5060ea9d4a0e65
SHA1 20e68640ae61e66fcce2ea2f059a74c8f14f618f
SHA512 2d5e6493fc735e4845bb0d268380e5b72502d7045c32146bcba792e92a33d034f6bc978ad65e7de1dac684f7e1dfca31379d45310aa335b71946532328c70684
SSDEEP 24576:RW6BApg2YuyuNDYTabvcdvNYf8km1VXUxw7FLf404cFVQj0N0xAJ3PNN:RF2YuHNETovAvNYf8km7MwFf404/+NN
TLSH
T172858E6A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0873a4d9df81e8e2add88ceae2bd49ae7eb5dd78ac5013f803caf4f8a1e75176
MD5 e2ea1d93910ab48fe406672ece2df3a4
SHA1 fc4080777e9642e966f1330739b1f268423580ed
SHA512 08f35fbbd5a66d3f0734f55f3536e14a858fd605c5c3820607750c2ca300d205b78b3ae7b011ab05448de63596e232f66f5c0fbbf8b01cb2bb8877b0186bad6f
SSDEEP 24576:TAFs06+Omlf8NXEbTocXUxw7FLf404cFVQj0N0xAJ3PNN:cFs060lYXu1MwFf404/+NN
TLSH
T17F65AF2F62EC00D5D07ED17D8A97C91AF6B1746707255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 134966ecbdf8e36e4db01e9fca44b15a8041ab9188dc0d6a900969343ab373bc
MD5 957e9f17c0b7bca1603e52f3a2a95d98
SHA1 6458f81054fdb74b4a35c2be014fb4139cd947bc
SHA512 0c4e2b85b63b2c298502c829956abfceab8bd09e80de656e11deced72f0f61b99d4ee456ff4b549ab7e0da1832eba6a2b5dbb64c9630072a154d6ccb10b68bf7
SSDEEP 24576:nJnJ5D3WXJXUxw7FLf404cFVQj0N0xAJ3PNN:nJnJ5DGX1MwFf404/+NN
TLSH
T1AF75D02DD2E810E4D4B7C374829A1B55FE72382D2F2269CB24B4D5357F22EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2e0a7cf484a5bd56915ea4f743819443425135194905c11221de35966e08e1f3
MD5 794c3915859c673cae16457363450378
SHA1 a45c122eb95e6d112ba67d7df2d59a61a4b8ce70
SHA512 8ca00ee091fe61e4a8fdec2e4a131c0c85a3710e422d80847f443199850d5dd99b32dc9de217a0ce502fb6217f702c75d9525228f5e410296b004b244c84801c
SSDEEP 49152:Tg06DIKdwc+eQnSt65aVPMwFf404/+NN:sDFfZNN
TLSH
T13C956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 b64f911531b05c6ed9fb4eb3df58ca2d2bcae43548306a35bd760915ffff4241
MD5 91206571a69da89fbec0e8dbd25c1dfd
SHA1 6a66770ff9bbee0c1a02cc4cb2619a437925b426
SHA512 62060e2190fe37df003d5857675a2ae8da3f0826e470a939ebf86d8db7e8a34f599d20a710965b639d4c680d29509f82917f19752b006207bdbead301782a4b3
SSDEEP 12288:oEP3RndNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:DndXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T14A5512AE3AEDB0D5D225523DD6928614D372F4642B921BEF12D1D23E8F378E52D3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 598fee12d42803c964de55269687a2e6439e20479685030e4962ec6335560e69
MD5 ca931df7fce546bafb160523b2d2385b
SHA1 a07627e8094223668fffb592f6de5bf4d45346fc
SHA512 18ec4509aba267e5a9a7a1bc5d299fdcc0b36ef876cfceb429aee46fbf922344de859f24ab34fa94670a53356405c164179102d923594f81b343341aceb10467
SSDEEP 12288:JjkyONNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:JIyOXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T12265124563E8A0C5EA75033CEAA386649A35BC105F6146EF52D0F63ECF37AD0AC39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 1d3ef35eb8cf54e9c43dc0262214abd2773f30a9cd05cbd79286be0b65fe7739
MD5 f380c354c7fe900c62b67923a1463cdb
SHA1 f5daddfa1f3ba30068732453c4a56d531dd551d7
SHA512 ab69b316fd46a7047650fabdc15ee3854b73b67e780ec76bd2fb574b17fe7256fe339d846e6fdd6ba25e2bfd44e2fb5513931b55eff9ebec3c6bc96ffc3b47ee
SSDEEP 12288:1yINNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:UIXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1EB55239A25EAF4C2DB20037CEA929E2481313D492FD6087F52E5F579CF7A8D16C7D818
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d1b3d64a08abf8e19266e0654eca55276ee7b3027b1169297fd7f2ed3a2816b0
MD5 7962235633ecfe171a949583b40214db
SHA1 6cb05aa5b7d47e9843ba449e2240c81c88f00a99
SHA512 1b1c3d7c73dd4c98cb9af6f4ec65dee7fdaf2e42ef8795886a001df5d4eea083485ea06169ce3484518bdf05223551faa8401e57e417a72281c99132a7456236
SSDEEP 24576:DQ9MxZKdcz9dw3LXUxw7FLf404cFVQj0N0xAJ3PNN:DVKZTMwFf404/+NN
TLSH
T147557D2DABE9058AE177D27995A250C3A633B4311B35C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 47f1ad8ba4afd8e7da4a8b1bfd85f8781c08bfa85232d8d1122dd57b4bac547d
MD5 77da901b706755b70ca09f37041c04c8
SHA1 c7459c9614990d534d05107555f551d148b7275f
SHA512 86bfdbe8143318eb185d73fd00c1792aaf938b55b167117fbfaad5b3eaae2c80264ff6997880078ac47b42253b11ae6ca9504e4a8419c73ad588e9857f02159a
SSDEEP 24576:QyocDApSXUxw7FLf404cFVQj0N0xAJ3PNN:docDApuMwFf404/+NN
TLSH
T17365E05FBBAE40E2E162823C89818654E773B4301B6257DB5291C73D8F379E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fb0401b664c6c3697a2bf7bbdc0fb9459e625f73380b333cbc0446d754135ac7
MD5 d49f0fd3daf6878c5ddc3480d6669590
SHA1 2d188d0c0d524e6fb377b60fdaa1b222b5a30c7c
SHA512 dd1ee79d8f5af67af53b3cdcc0e28f3fe34ac7d14f87aebba9c2ece391828268808eda8412cec30c34eabc78d2aa93d25e87757689dda1ca4c07cb9f95481bd0
SSDEEP 49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKuMwFf404/+NN:k0zuNIEFfZNN
TLSH
T16FA57B3DA2F800A9D9AAC379C5461365EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b28869ba2ba2ad561dea9b26f6332bab13dc5b4d584dc4f8240d2689ef8bca17
MD5 86d139984982e0df3cd9f4f0e3a124f5
SHA1 2878d78d561f0c03f3302a6588164b37e1659a5c
SHA512 1e462a07ec471a3194950b77f75dcd24d8887ea980419cd1133c8ec03e9e80d9b37f14240cb93cace41d7c65a5e5b27b2bd26ac5b267114eea934d934bd5396c
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYqjMqbdXUxw7FLf404cFVQj0N0xAJ3PNN:uTDxR+N5YzTEjMoMwFf404/+NN
TLSH
T1E855B02EA7F855E9D17E86799A23C512FA727811033193CF42A0C17E0E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 2e8d7e57de6a0490c29b68cef09a896822bcc6a39ab7ba49ca4adb123d2e8cf7
MD5 fad3748911f71167c80db4f0662b9911
SHA1 7601bcdac7e655bdaa4ce67db7e4e17d0ec044e4
SHA512 f9917590b3663ee56db03280ef5df671716eadd4e910443d7371ac2ac59b1997c0803eb199617202b0dba8a1341021fb539b77a4e2ddc4fe9eeace654e275f89
SSDEEP 24576:STMdOz0FFS+vmSLRXUxw7FLf404cFVQj0N0xAJ3PNN:+0K+vmSLNMwFf404/+NN
TLSH
T15C75F17E63AD14E5E57AC27CDA438906E672386503226ADB02D0C1796F6BEE47D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 6e1b2fc3d944e3da8ec36bf02d36810341359947d6e2e659827a644d4ee07a79
MD5 9083ee2f529b23834d3f0aee2ac0913d
SHA1 8e49c542124dcb7b91549d24abea64c8ef0d04d0
SHA512 622c29f8a0310a9e9fe3a4e55380fbee7aa86e94b7701a5468d8454ffb5d0ceedc1ccf0940eba10cd832034fa7179c01dd55a17d74d664536086ce2834150199
SSDEEP 12288:t4KUNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:pUXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T17255125E26EC70C1E5715338DBA246248631BC6927A50AFF22E4E97E8F378D09C3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-351-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/436-157-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1056-27-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1056-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1100-111-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1100-159-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1100-117-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1544-161-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1828-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1828-396-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1828-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1828-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1900-414-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-421-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-416-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-415-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-422-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-452-0x0000022B5D920000-0x0000022B5DAFE000-memory.dmp

Download

memory/1900-413-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-433-0x0000022B5D920000-0x0000022B5DAFE000-memory.dmp

Download

memory/1900-412-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-408-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-409-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-410-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-411-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-417-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-407-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-406-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-418-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-419-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-405-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-404-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-423-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-424-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-402-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-403-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-401-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-420-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-425-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-432-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-431-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-430-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-426-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-429-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-428-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1900-427-0x0000022B5BC30000-0x0000022B5BC40000-memory.dmp

Download

memory/1976-284-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1976-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2288-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2288-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2288-54-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2288-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2288-60-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2424-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2668-155-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2668-100-0x00000000008C0000-0x0000000000926000-memory.dmp

Download

memory/2668-95-0x00000000008C0000-0x0000000000926000-memory.dmp

Download

memory/2704-88-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2704-82-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2704-154-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3252-165-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3252-399-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3404-169-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3404-201-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3404-185-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3404-166-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3404-400-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3404-348-0x000000000CDB0000-0x000000000CDB8000-memory.dmp

Download

memory/3548-135-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3892-162-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4056-378-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4056-36-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4056-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4056-30-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4152-168-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4152-78-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4152-72-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4260-21-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4260-287-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4260-24-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4260-15-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4656-156-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4736-158-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4840-398-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4840-163-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5052-167-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5052-357-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5052-1-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/5052-6-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/5052-0-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5060-122-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5060-160-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/5060-128-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5108-68-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/5108-397-0x0000000140000000-0x0000000140210000-memory.dmp

Download