1b4551127dfca052661b2b297b092911c27cb266ce5cc34316220cf7920909e8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
Size 2.1MB
Sample260823-prhejsab95
SHA256 1b4551127dfca052661b2b297b092911c27cb266ce5cc34316220cf7920909e8
MD5 107d23c6ff79d6f6b06f07b9e5addb1a
SHA1 c08284e8081d262dc9d75ba19af4cf1287de922a
SHA512 76ce76af37bd741b50c7b32b4cba11d935983766d705bf7a04baa652a4cd5e59f5f0b3462ea78bc15d41e3f5a1884eca3c3628f55388dabf76a7a34211c94047
SSDEEP 24576:VdY4jyB8iFTEIK5L1vpsvUrdp05K9orBsqjnhMgeiCl7G0nehbGZpbD:VKSyBpFTN01vpbrjzGrVDmg27RnWGj
TLSH
T100A505377297D0D4C41D90B4CF160AF595A17CA9C7E59BDB01CCBE24BB32AD03ABA609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2496	alg.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
4352	fxssvc.exe
1920	elevation_service.exe
4260	elevation_service.exe
4852	maintenanceservice.exe
3984	OSE.EXE
4764	msdtc.exe
2016	PerceptionSimulationService.exe
3964	perfhost.exe
3224	locator.exe
3248	SensorDataService.exe
2196	snmptrap.exe
1964	spectrum.exe
4556	ssh-agent.exe
3468	TieringEngineService.exe
2892	AgentService.exe
3324	vds.exe
3940	vssvc.exe
4576	wbengine.exe
4144	WmiApSrv.exe
1864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b797ce36e52bf895.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4e7b6dffb32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010bfcedffb32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003eacbbdffb32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f55f8edffb32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000436799e0fb32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055f626e0fb32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
1920	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe
1920	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3884	2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	4352	fxssvc.exe
Token: SeDebugPrivilege	2032	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1920	elevation_service.exe
Token: SeRestorePrivilege	3468	TieringEngineService.exe
Token: SeManageVolumePrivilege	3468	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2892	AgentService.exe
Token: SeBackupPrivilege	3940	vssvc.exe
Token: SeRestorePrivilege	3940	vssvc.exe
Token: SeAuditPrivilege	3940	vssvc.exe
Token: SeBackupPrivilege	4576	wbengine.exe
Token: SeRestorePrivilege	4576	wbengine.exe
Token: SeSecurityPrivilege	4576	wbengine.exe
Token: 33	1864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeDebugPrivilege	1920	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4852	1864	SearchIndexer.exe	129
PID 1864 wrote to memory of 4200	1864	SearchIndexer.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_107d23c6ff79d6f6b06f07b9e5addb1a_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3872

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4260

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4852

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3964

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3248

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2196

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1964

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2992

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3324

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4852
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 56bacf94aad7b58b238a00e8bd8a85c0ee779147108cc6f09c92b8eb1bb25a23
MD5 6dd6405fb7db2b2af2d0df77f9a468c3
SHA1 00277db9e3cde19f7da1b099552d01eb7560bcee
SHA512 d2d65b4f63e8e6083d5c4b94e5d12bef09c7e8abc105b30fb0a1c90b4bc397393c8cc023bf250e6dabe0413c261ab8ae4238f7862ee9465cecf7a6efd6aa2446
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxDmg27RnWGj:W3q6HjBeD527BWG
TLSH
T1C3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e1ef5953cbe434d75b93143b4ea71f6323c9e6ad31f3177ac2e1e204faa680fa
MD5 b74883bd2b7d7d988b64dfb7ccddac9d
SHA1 4b21ab3ead2a8032bd1272945d11dad8c9175211
SHA512 7cf9642f158bbdd154e1f84a95f36d96caa48daf4c7ecff4d47edce2bcb6b1c88f9637fc513826a77b74c3a54954c44c573e969588f9f87b355cffdf93126687
SSDEEP 24576:7XYfDtczAosqjnhMgeiCl7G0nehbGZpbD:etc1Dmg27RnWGj
TLSH
T1D7650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4fba55d345290dcebb578a61540c4af6d81639740a1f463b098407983c3608f3
MD5 d928f6f456809f6397e8a37046c802cf
SHA1 8e82cbeedbbe385181e0e683c3675e84ce09e0f1
SHA512 cb5c6f3a09f38a18d94688bb110eb99294e9e298ae2d2f41a0556a1ade18a55f8147553b76bc2d3a37fc319452b338db898adeb6ec1255c1d0ba09d68b62f4bc
SSDEEP 24576:L0Le5ji0hmxirMzsqjnhMgeiCl7G0nehbGZpbD:LPji0AcmDmg27RnWGj
TLSH
T11D859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a3c181595d96a60f5ce56b20f3d72382aa2347e9accf50a35a54c10b8bbac606
MD5 08b9ef3b1cce170065726d7a0ef3337d
SHA1 dd7c9061de0cfab19856862f4ac8a66d02a3d71e
SHA512 c355b366db4fa9758c886e178efa693f8bc6daf879d50bfe471f6867205ee053d0d10ddf6db63f85f3facd94fb21092c541982333f6b9fd29fa21e89203b00e1
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyuRsqjnhMgeiCl7G0nehbGZpbD:L/ezSC6vUzPvxHjyCDmg27RnWGj
TLSH
T1FC755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 023eea596ea44ac159ab896465e0ecb4f632520c28309f69396aa69fd6bc6eaa
MD5 fe5ddefbd4828f97d43bb50afe378f0b
SHA1 160e6cf1bf4b83d28fe41e919fb482dcbebf2286
SHA512 716f84e8ac6472691de9378bc1635ca80acdf8f89a963ffdcedb8e553053eb9e2b15df62aa6cf4d49af935f2465fe6be699d7304fb1c5757ce8c6909abbf5b3f
SSDEEP 24576:UVbqPb88hv/l+68sqjnhMgeiCl7G0nehbGZpbD:UVO88hXl+zDmg27RnWGj
TLSH
T1CB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 526ee84ee9c5949be5a8a09c6db64477989e46b06110b08aa3b7fb3b6479cece
MD5 08783d1adc1bbe8cf6086292d54c1626
SHA1 c3980a9019065516a61deeb77dbad374d537b5e1
SHA512 8e6adba5aa1ec700a3439e223bc1fc57e200ab15fd0704714e414aaede1968db19ef489488256c299416bc750ca6b72ee939ca403dec13d88b6ee566e842e1cc
SSDEEP 12288:NRXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NRXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4dbbcfacca6cfb6171b85277e8b445549c0a0f8a166bebfbfc056bde33053e3f
MD5 8f66add3a868a714971ae6e76ab58541
SHA1 b21741404ed6ffcb2254af59c9e076e6d21e6345
SHA512 d7f3494ce7ad45c79bf2aae96ec2e1da93e7e1c867c775fd14b76aff60bd4cf211b194cb97bc9762e915b989ba221c42528e12de99e979f2c51b088e5790452b
SSDEEP 12288:AeBNUbTVO86U0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:AJIU0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6ba025e50aa3c8c7875c00ec0b8c0e0b2fee0d75ec5536148d8d488af8393ada
MD5 5b7758e7d302d594e907014649bcdf97
SHA1 3701adbccdd52bfc9cc0523d2e80e0099a1c436d
SHA512 1dcceb67511702947918fde6216bd5634ea3f463df581a321e80c7d2686d4dcc31050fa5e996b1ed68f2f7e4a22ad0d3a4ae17e404a1e7c38d84d0a92e0580f9
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:5QvGAdlCEL8c/yRNw5CVD527BWG
TLSH
T17F266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8e6cdcd53980b5713971c52d6e66ba9d94998a84c2cacb5da393aff2b531783c
MD5 bdec87110ebf319ff946e50b222fe592
SHA1 b409de429d31817b3921cc79026575e7e2a57c93
SHA512 9a29bb1d43e72c2a3b05c3f27e309f22891786c5e1656af256327055206b09d4a9a93f729f78d26d85abd080f55a5fb775864fe0b1464698e63576465d7eed27
SSDEEP 12288:cAwSfxL/2Dc34DLLmt0LDQewsAjSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:BdewsAjSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E075E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5b45efca443aa0912d588161a578c1951b647cbc4651b12f5b9ba1d77b0efa64
MD5 0874e80e0a7f8a92b7369c446c6223b7
SHA1 12cafc4dc0cb9c9bc2bfaabf6a20b90a57dc28b0
SHA512 da62d8373cfca99c92e404fb6c6d2289707766223de04b1280296f0c9420b0c0bdca98149daa94da5829a5b00a4c05e4f414cb74169338858bdd83cc45514d27
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHOVQBWG:oUEtQevvqc2W1cpV2EI32BB
TLSH
T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a5b9f185c4ca04c1a4bcb526a526b6a467c94da5aef92bd7fe74fa98f91e5a90
MD5 c5198d2289d4d019a59e3bc9dbfddc47
SHA1 7b328b9fb7be195adfb2cb0a44135f145fdb39a4
SHA512 c7ff5f413fe5d859cd8e97f27b36d1b398bf9de17078979a8fe2a672eecd2631fb73cc48b37ec299053bb74d198a27fe289ad19464110262984cc3cb22415306
SSDEEP 49152:SCbRquA/m2yL5zLfFiV+XenmE3/z2Dmg27RnWGj:3oq2VjnmRD527BWG
TLSH
T131D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 847e48abf05a70f7462f275dbf2433e50efb15fcaa07ca73fba71b04f59cb4ce
MD5 a78ca0647a54b7ac4d7e320c04ffc6df
SHA1 3b33f1260e6d60f6bd386f973783015b40a68ddc
SHA512 9a0fabeabc23178a5d8de9043089edaa5a4780a4dce51d54fcaa2d6841e70def568ab692c38441e2c1caa5eb59fe79d2cea31807f8de583ed27057d6a7f0697c
SSDEEP 24576:BAhGLJIFoiwtA5l7S53NsqjnhMgeiCl7G0nehbGZpbD:BAMyFoiq5BDmg27RnWGj
TLSH
T1DC359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b2a8e1e28ea59b16576f7acd92ec9e75240db225f7586c1be00b121ccb09f393
MD5 48e5e37df2358e984de9fa7c78997fd5
SHA1 9ba356dd7f4b523a90ca3c4e51e37e2bc1250526
SHA512 ef733df5a00b09fc655dc5927693bf7e484d3d1e173d3c91b02c976cf8e08a93b25207afa860979f819bdf9df8ebbe754e61996e0bd80042471b3e37cacd7f06
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:WwuoOWOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 336a57821c101cb62aa8c924a7031df889341979069f44389d7987ea56165af9
MD5 4104c86fe9f95bc707685a9089530e43
SHA1 68566fcc8fa0b0d6777e12806db100823170d227
SHA512 4524e852f97e7154ba14e8b48eca991b76c7ee32f08e8bc503e3f22ecf609dbb6584427591b13f49322b06640f22d9da26e88fdba89122afb744b9027c50b2ee
SSDEEP 12288:7BZ1IyCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VZuLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A35512AA239820FAE1A3417CC5E5D609E7337C62673003CF166656AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 19f2b6f983246bd1a64e8ab8f1cc3be29f7ea47142ad1c481e65aa22fbe0fe0d
MD5 ec86dcdd513ec51ca143f1f32453ed3c
SHA1 d0dda3b6f92e8a16414116418b4db05b8bbe034e
SHA512 483588c8d552c0a192b0ddf8c161ef2e1cfeb27d83c961600a8998674e747ea8ea1be17336e392a1deabb3e5acf7252da35158b9ea24bfaa14ff83cc3501140a
SSDEEP 98304:6QRQyi36YOcPQLvw2gAf+PN3cD527BWG:xQyiKayX+PNsVQBWG
TLSH
T16E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2da2f9e02365ef67ebd9e416b4c2baf287b9e2948e57fb79f5f1622cd3b52250
MD5 22c940be5522c3c933caaaa8de848a5d
SHA1 aaf14cb59bb8f84a25df30bcf3466f1f75853cbd
SHA512 84e2184a27ccb03a89a6097254c36256956e6c56c692f632b2a11cd381d7ed0520862bcc26dd8082e00341f60cf0a01152fec221fca33ff565a25051e8e51590
SSDEEP 98304:fQRQyi36YOcPQLvw2gAf+PN3cD527BWG:uQyiKayX+PNsVQBWG
TLSH
T105667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 df770dcd531d73e53c5bcafceef2e3ff411f506ae1a70738bccb4e4566606cc0
MD5 2edd41ff712a16191f34b087285a830e
SHA1 05f5576eca16fb4b0c45b3750c0d5709ba0d9111
SHA512 1fd63b743ee437960b0606bd1a6f7c8b9444e382e3b18e9077ec602d7e530f9e07df718bf1d4b69722e9a3d76b988d32f9d72f11f6367b4c1a3944b76ea9518f
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0bsqjnhMgeiCl7Ge:k68Qg55nhheWu7PNU3/mDmg27RnWGj
TLSH
T143B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c7661701591ac74692451e9d229d9aea31f6b787088aef4c8b2011dd4660625a
MD5 e8afb0e7a7177e9a59b7592e97af99ad
SHA1 b098616b2fcb82cd6bd43616d683b69af84477b6
SHA512 e323333d229b7f143fd3276af120545ba1140de6828a4bb4488b981288f3da3b30c2a4f55a88530f48f8844424baa0f1edeb1f3b735fe05854c14d8f1b85a06d
SSDEEP 98304:my5112gYy5azzVvL69nLKnhZrD527BWG:XLIHmWhpVQBWG
TLSH
T17F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6332eb82088365d5a755dad91e3d362e888c43557ef06905020d0fd6bdeb609d
MD5 efbe74ff5a3aa5ae4982ca4d514b5d91
SHA1 c59c1daab7dcb15c49c59f85f8f6ad70eeff992b
SHA512 e1958b7e3e163ff4b63799bcdab34d041aea0726b119a038fb48aa28fc89d4ea865af382d2ef5df639e5123666de90066e6c367294699d727a72c017367a1161
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCDmg27RnWGj:4u6JmVxd2dCD527BWG
TLSH
T14AD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dd3a8cf775f2971f4a8ab90a228bd4a062f8af20caf09946f7eeb481190f4281
MD5 f544f2bc9682d978f6d838dd2c845860
SHA1 18bc076b6b840aad403a793f5c6d735cef721c8b
SHA512 e8bd9c97327e573c89ec83c81b6982da3d9736b47520818c412b76c113bca012cc4359faac0ff0d276dee96ec89df30f8d1c257eb36fe8b84228f72c248b9f38
SSDEEP 49152:81hpsNoJpF1A6UU44CwH7R4xwDmg27RnWGj:8mifPbRRD527BWG
TLSH
T13EB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6559ee221f1b14db3be83b738e24aa0bac98aa487843b6c831df66bb7b1190e4
MD5 3805fb10d537e09e5bbc4351d23000d2
SHA1 5735a65aa28f42c790e92007d21aaca6d83e72f8
SHA512 524ceaa8fb6edd31a9cbad92e89b7a832647d98b41518abbc1e782b8f75d384d71e6de354e76a34c649dbe038243dc3fc276105238faa2d5e4fb82efbd1074b5
SSDEEP 49152:DSuZQIY0Be2KRRVtOnks6NMHq/Dmg27RnWGj:h5dKTi61/D527BWG
TLSH
T16BC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 edba95f87a4f76de7fb65977dbe4c79f2a19963f0f0765196d0fb40f5e06ef99
MD5 3bce3bcda093340611d2569925845166
SHA1 2e6294f1961652fa438eeb157ccfbbe2f33f2473
SHA512 e959d88bcb557ca6965a64ff963217830ff5f78cac386a5429f671142b246138d2600f2d281b98455e3bdd8995bdb1d1037f7ad9aa64378f84dca4d0616cae07
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wUDmg27RnWGj:zX2iyphND527BWG
TLSH
T11A95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f239b19400a40e7960294de1f79ec84d81c5820ffe2e3e8bece009b7e747e599
MD5 9805e27a77a9c62212812769477a85eb
SHA1 d8f37cbff9e46e34051ba5a7bd93d22f4f412750
SHA512 924166906453827f972da74bf6e5ef9480afc5f5d85a15c6a8c2d64338e801eec77d9b8056e39fa52d56e862ed161a14e5374a277af6ccd8b984cb6dd99258cb
SSDEEP 12288:wPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A977CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e9152240b24101d8abd52de8303fe36772ea4a0560ed2ebc47eff440fbdd3a2c
MD5 c42d66a31524bf19d2d91f966f2f1aba
SHA1 6f12287787b4e6410690e8b68e3c609485b0ffe4
SHA512 6f12d55a18d24b63a4e699b8ae0b1f77826d3b177a50b8da67b386929819c57249a43e61841c4e1d0d5b1574c9aef197ba67045ef01faa8edddfd4f09de15b97
SSDEEP 12288:I2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C74523BE965C41CBE52648B5C3E5F10DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 87d9b95f9352f584c33b24c63106e6a67eff0f92d1c71bbfd8627bf47247e23b
MD5 36d245b6eeda25241bf3c6634081de01
SHA1 378abec8a8a73ae69a94ad89aedbf17c8dbee692
SHA512 1e6857983506a8f48e030a80ad5a481e36d09587f11a316505b0e042b647f8ac94d958b7c27dd806bc8293de15a9d13dbe4e066282da3bcbc8ac4f2ca50317d9
SSDEEP 12288:VMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1104523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4b1d1e8344643a07b70d73945f7a79d531f7ec8aadaf8678c246acb76ce37736
MD5 db15ec64087d05426cc5f4719481b82b
SHA1 7fda89ad522b3af30da1a121a0bd2128b12df911
SHA512 03ffa8104634aee083005f288140cbb358547b0cc5347fe9b2dda595a1f09c30028eed50979f4d5e1adf11365b87a34a31813d4b4ac0efe6b074b56633116ba9
SSDEEP 12288:fVtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC45236B575C00C6D83285B4C2F6E11DE8277D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3c63ee9453f5a570df879eab008e9882517f8cc337886ff8eff9b5679685b8d4
MD5 6fe0ae9223033dbcafbb0cacc70de908
SHA1 8929fc8e747f244f2b1c6feecc0b9eeaab1b4be8
SHA512 f0951fccaddde06b63af3bc7a48d0b6f1972c4d112a247469e4f1c1e228f54dd90a31dbce0303acc5d2183732becf9ca29e1cab92cf8d1ac0865634f40681ef3
SSDEEP 12288:7VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1744523BE965C41CBE52648B5C3E6F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b849d4af503762e105236533bb2566d28658c98d87134f7eb039597dbe2f22d1
MD5 7b38766255d6ccfa52af2a90a9540201
SHA1 ae5ffbf8e522908260e09fd142c1e785850a0177
SHA512 84ece9267c0c42e81d8df4970e2d6c4b4cbc971578f30f7468015386b681e1d3296d935d6e106a2b2aa20751bc9172cbbe05fcdade1782ceee09eced67d654af
SSDEEP 12288:iqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 213ccf7107a1da2f1a5e407c4da57e52f2a9e992e6e4a9e562271a86f5987064
MD5 2eedd05ad2e11978980595dfd29ad157
SHA1 38eb2c9eee1ad322b7499eb7c00fbd325d63caf1
SHA512 84bac19ad99fdc1e54cc51f123866a2cca95c5ea6dad022513e4ed5072e7c2b70ddaa69ad7132c6eb7486fe490ae8499bd4b6c8f59fccf6a6a3e2b9467e6fe52
SSDEEP 12288:FeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C74523BE965C41CBE52644B5C3E5F11DAC073E6BE92004837A677CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6055819a16eed068918a9b4ed75e2074fcbcb2a9c0f8a618e9c0f9b547db0a85
MD5 b11dd72c9eb8022034ebc847703ba339
SHA1 14216f1002e0dc75ab21a8ec097721c8378178d3
SHA512 4e3437eaaebd45c364f83736b5ed6114b5d44793312e6fe695ec112bf9a62635208926baeb7c0e778c67fd405955cf512bfa1eb3fa2370b02f6eb900b9a0ffa5
SSDEEP 24576:AZMSzFVSOWsqjnhMgeiCl7G0nehbGZpbD:AZMSzfuDmg27RnWGj
TLSH
T1CD6501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 648248de05c5028c9674e29689a3a616bc93efcb8b3691c2225e49ac6845a438
MD5 6a8a8ac48e35d8df7a3be7ac8186c7e8
SHA1 2af81e2cdfb0a0ab15170c96e4d4d6d1c92432a0
SHA512 655c895e66d7902881061e0e3a7f00b0936904079d99d073720183f07f322fc014621bdbb33c8621321fb7cfcc5ae751f8804f47a623547a00e5a99cb7492a19
SSDEEP 12288:S7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B24523BF965C41CAE52608B5C3E5F15DAC073E5BA9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ec3722d2a4f3224e3dbd5f9ecdd70a95ebccd30f16862246d8b25ed214f54fb3
MD5 aed10537975ce2a6b955a389f38c1fa8
SHA1 1d892a5ed2f12dd719795c51829c02ff9403a7d2
SHA512 161817dbc5e46dc64381109e2e4a1adc3f73e67595f9a5b38e494477beca38fd75cdda840bffe0d41d43cf08419145af6680def78644d5314fcf476f14552859
SSDEEP 12288:dHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BF965C41CAE92608B5C3E5F15DAC073E5BE92004837A6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 51ec4ab2c27b7fb3cd9ef61f094edfae140e77f570f2ef9d9e7ab9ad41477d2e
MD5 2d401189247dbf7b25f63f9cacb96a64
SHA1 71329944ce31c285e49e36826e727bdaf92995b1
SHA512 b180e63a038d93fd504190fbc53d09570e60d483879c49a05c6873e04e00336bebe27c0efeb7f482480a7e05c72bd5deb5a2166d969e2252f29b3c08b51409cb
SSDEEP 12288:KyPz5L8CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XzyCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11755125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fa35acd36e72b74c56e49b9ef3d5ff0942451f4b586906a9f0af56440f757b12
MD5 9d73e8a354fb214448b396144aef2b27
SHA1 a408746f96545dbaa092b5ac1ec0103ad655fc8e
SHA512 e1ea148dcfcc46731bd5293434c0c3568b5c9cb8811cc2f2b49693b411cdb6f256bbebfe85318f6faa9595287d8770fe3222d8dbdd36f7695711e17f2e9628e2
SSDEEP 12288:i7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 72f0702b2870435fb337350dbf6ccbf2cc9b5d087684b83e5cd2e20939af8c66
MD5 f5d3bc3e61d7a8b23f23dc48fcde5abf
SHA1 960095de8520595b5615c0d6bf5b29ad73cd3cdf
SHA512 9bd0ca8dd07fe2f723caafb34c950fd89d79477d289a1eae38ddd313f25ede6f5ab785af67503ca606055cca00499d805dd9807a0bc9f7811177cc73c2763534
SSDEEP 12288:57Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:57sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 89203a384237cd6457b96afd719d98583d357426db387a10863e2b2ed3d9e830
MD5 b2dcaeb8e737bcc0224beba6e2f59ad6
SHA1 3eeb554a2a47dfce4c8d0bdc046485c33b75260c
SHA512 71a8849e593d2335abfa173702dcd5866a749a084106cbfb1db6bebae8d194bca33a14df89f99c960b328b55d2908502faaa3b377e1ba034fe67ad89b1a98a97
SSDEEP 12288:jyPz5L8CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OzyCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E955125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8d9fdb81394587981afb06085d5a1d93e590bbf773e375a5241a3a5bc4dad617
MD5 20adbe7333c170934c233360aa123513
SHA1 0b567d527904f4abe2d7d2d93a0029579e6d8567
SHA512 aa04c2ea11c55803c27cfa21a527b05a5d22ca7d08ea4bd148bad6ab6dfa2e25b15aab074be47db29f6f9df5b35dd7af137a55849ff2b9cd91e980a17783daab
SSDEEP 24576:tTHaLl3z0zDcsqjnhMgeiCl7G0nehbGZpbD:tT6LljlDmg27RnWGj
TLSH
T1426501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 501e73eea2ec14298929fc80555c6ab47e3ba0767af202ef1492c6a5de7ab24c
MD5 1ecd9ede11e3a96932e770e1668199e6
SHA1 13bd9982b969263a00d93ef539186ddf9b200636
SHA512 bd2682aa187f2a89bc6b5e2b7db988f4b0bb9dadd0e575f8b5d1f33c91106071be9b954f287280e25ccd10bc99aa35c35a53b1cd1388985bf928db4549cbc6ae
SSDEEP 24576:137d9CHKy7GZAsqjnhMgeiCl7G0nehbGZpbD:V7d9CHKyauDmg27RnWGj
TLSH
T19E75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f0162f14fd5778a80b6c0719c8d3622dd8a1c8fe12df33f0564f203862121f4a
MD5 a38b3aab2538f1d36a865c80a3455619
SHA1 70d31b4125e2e66e66bb0835172e75a05af24534
SHA512 d72f45734105d3ff4ec142e5feeb86682aadf478fdbc895983108556eecfe71ca74389bf731fdb53b1ec66e23fc48ff6190d59bb689def9b6c7e915f1f47820a
SSDEEP 12288:IsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BE965C41CAE52608B5C3E5F14DAC073E6BE92004937A9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c7f34ebf3c0f5f90be1df211fb640414b1d4783c0fbc193f61d03d2764ab0832
MD5 f84db4b650ea2c643a17e36aa7361efa
SHA1 e3c5ae842a98fe71b143fada52dcd975cdd14085
SHA512 5335cfdb90904e45ea4c3d8ef0bff84718004d35ef8cbf2815fedd59bfbd476c6dbd9060e5b4d66b540f5d3494c170722ce4909a1aec3ea3e4a0bdb7ab6aac75
SSDEEP 12288:ZiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZisqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B4523BE965C41DBE52644F5C3E9E10DAC073E5BE92004837BA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 493f5381857ff396b11e6bcff2102258d41aa7d08e5814897f91f549a609dd88
MD5 38fbb71e0c2e3663f0478226971553a6
SHA1 302b832afbad501a859f5ed81492c0d335dbbc28
SHA512 ccee4a3d9a1c2d010396402c5bd10b53fb68668cc675f4c03e73fbbbbffabda2c4b2d30f0c34506ad701f25e3d177cbadc5e09e5bb4c81a0f36143978b6b371c
SSDEEP 12288:i5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a38f6b6f38cafcc37e3eacbe24532d38526687b072204a03bf761743ac75d816
MD5 bc128d2b21d05a06ae4bb30f60cf6eae
SHA1 35a2c563a6ddf016be69c7805ca049e31de68c70
SHA512 468d13a8526df255c9693f20bc06749afd8719a2411dc4e0541c8f5abfcceb5f15f7d624f45eba937463cfc2c84f0b3ea12683bdfb9a796a7889362410b4174c
SSDEEP 12288:mNsfLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12455015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 44fc239beb4ba6bb8c8e4a9cbc70e25b8e5bb2e7d48c779a32bb4043e3a19cea
MD5 90a75a486c71229dcec16495503b83fa
SHA1 a35a9647babaa6bfc82a8b943c60edae0f804132
SHA512 d8b7dc251e779cc36d76deba1424dc6c59c015163b31cccaaf327ff4ae4b8c2e84c19e287b82482c334cbcd3c95f61f40fdcaa753745e1cad54d23cc329ec4fb
SSDEEP 12288:XhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18545237FD34C518BE57649B082E9E02D781B3E669E204483BA4778FDF6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 380f709732c415281227abcead022e33dc44967901acdfe4bd72069c68bc8adc
MD5 05d3d6294e6dda0f03a760bc52799f58
SHA1 5d4a9ae9ad2416f7ea28e28556ad58018548e1cb
SHA512 f322b6f977fc46ed084cac2fe1f37acae7480e51fccdaa74fc01d6bb33fd138988f3faf76b18cf5824ade179b0671f04b3b804d3491daca3a3be8d0c5de45bcd
SSDEEP 49152:ja0h2GEkuAe73q3pp46zwwQfDmg27RnWGj:ja0hNYG4JwwD527BWG
TLSH
T1C885AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 be0f1ffe085b651fc71034f0c286e764cb584625ca180611af3147d164743a1b
MD5 83dc915e7b26e80289355850a7ba421e
SHA1 b91d0eae797b6456439f7c8a79e44401252470f2
SHA512 7596535ff0a8f926724dc4f6adc5145afe6b6069887310b13fce1200544920b6f0f1256346b2f29cd2b74b1a48a861491d763703722218e046003c0c775907c4
SSDEEP 12288:ihbHjfXYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ihbHjPYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A755127E16AC20C9E57291BD8296D10AD632BC26172053EF23D281BE5F37DE84D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2b76cd641104ab9cd35ff22d44709c16a184eab41caddf3a02cb78a1a0045d70
MD5 9e7a9ef556d98128ad4b732186a41b12
SHA1 1fef4e8ae69c0dd03a47ed0db515a06b291c9238
SHA512 da05db8dba5b7ba757ca6e08b06d3533940ae34f3086d264b8a34080c480a2faeb6d2149e25eae8c0bb766a6dbb70c4c2d058bfa8a6009d5eac33e2accd66f57
SSDEEP 24576:P3YgnJcRTk4yti+R5dBR/wsqjnhMgeiCl7G0nehbGZpbD:PIgnaTk46pBR/sDmg27RnWGj
TLSH
T15845BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c170993279ed612a369ca293cf228fe05d6fbc6be343fe674df74bb702095d5a
MD5 716afba3483bdeaefc83f3539f8a3ab6
SHA1 49746f64a3628897c0509cee75c75243763ac7f0
SHA512 6edc723cf53753528961c091482b24a28266155b2a54540d13121d094dd1bd6a8c6cb4593a8f265a9b0cb2d93bcaf9850436c291ee1b8521fb4fffd28be08233
SSDEEP 12288:ptXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ptsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE924C51CAD53649F5C3E6E11DA8073E56AB2004D379A7B8FDE7B14E84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 1704d54078768c967c4aa6146b4b7c46745cbeec5d7ed6029ee5ea0100915e11
MD5 63282c6ad8dd10b5638441be696664f8
SHA1 6fc0dc8a5134c1e18c7258a52c9346eab9e301a2
SHA512 2518076127e8a5f5cbd6a54671da7fb657889bc4e1b1977563a43e71affc8ee5f7c47ec1e9449a0b51fcc371309e65cf120527057cdc3cbec10813a6edb49130
SSDEEP 12288:wOb9A4LWOsvAYFTKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:tpL3UTKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 bb0121bd5c2d43548ec29d6048697b2f41b7a1146388918bd731ed6cd1e19c39
MD5 b5ed0a936e552de9a4477441c479235f
SHA1 cb33f155b176d3da2e21f275188ed39ddd47fe14
SHA512 6464a934707f331608041cfbc9fe3366cfea5355691383d00631ac1908d83cc6fcfb1d2abe8bf6fbe145aa407c5ce3f64700c0c2b92908e542f57f92b0af3eb8
SSDEEP 12288:SpFtpOGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AOGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11155022E33EC10E9E536917C8692D20DD632BC66072117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9961186750fdc257851fba1cbbf188692580d06b2539bbeea7b906a7ee1517b9
MD5 a6f785f03b363d3f345102ca9bbc8e7d
SHA1 d303a9a6c757800a395486f0ed8a5072435ee4f6
SHA512 cddb769f1fbfae59a40623b016ebbe0c4647a0a8619fb4663ce8b4cfed22736ae15c3ec7ed158c26dbb4d0f28fc33a246d3fb41f18479d1393d95c16530cc9eb
SSDEEP 24576:57NM9YqZqmWMUkPjZM48Mv6bEhsRsqjnhMgeiCl7G0nehbGZpbD:57cBWMpPjN8DbEhcDmg27RnWGj
TLSH
T1A5659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 09c0c5e850b8279b816bbb967e95e7dfb33e7cc6da9ac2e1a5fce2f1402a9fdb
MD5 78c8ce5e9c6aa2dae79343468e9b25e5
SHA1 cba72ae17e8a03145cb0af53403f08ea177e8367
SHA512 593810688dcac44fcf6876e1038b844965774fab0ffc1d8e601c120ee2cce04ece64f1f59339f5437366cc710b4635fa0a4d1305040aa0af1531ab2e3173c38d
SSDEEP 24576:uW6BApg2YuyuNDYTabvcdvNYf8km1/sqjnhMgeiCl7G0nehbGZpbD:uF2YuHNETovAvNYf8kmFDmg27RnWGj
TLSH
T1CB857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a4b13d03f28ad0a9d1a70dfd22c06697aaa3015632a718b9a837e943b21e54cd
MD5 b0b022e0fc121ea1cdf6fa1afe12ec67
SHA1 ded7de2f8b99aab766278c8b3d33efca8a4450e6
SHA512 be2ceb0b4b1c0a4f1f3c52516ecc5c99d7354bc4338f40d8dcd9d6bececa6d3ed09632b10a4c2523c0a90f6ebe6d890eb3c024d516a9d46866c4228ed2f655db
SSDEEP 24576:AAFs06+Omlf3NXEbToysqjnhMgeiCl7G0nehbGZpbD:VFs060lVXu/Dmg27RnWGj
TLSH
T1A565AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 59599847860d55e51d91826afdb49350bac0f5460ab8cf7d8a7b6e8551124cc9
MD5 e2a9f83af1bc95f3c3e3b46784bc5e29
SHA1 d4941bd6f04723492b35ac818fad25ee95275f5a
SHA512 84cffbc0e3146ddea662352e7e792f4d6e1c55f7e6dddbb4285b1ae65daeee57ac73e6a8397c2d7426ba7e7b1a45cec14c940bc79d9cc5063c40037cf5a1d7cf
SSDEEP 24576:eJnJ5D3WXLsqjnhMgeiCl7G0nehbGZpbD:eJnJ5DGX/Dmg27RnWGj
TLSH
T1C975E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b05bc945d2934e404e8290ac21da27606be3998c6a6494ee7656b92b5521f584
MD5 58a3b46d19a9947bf98068554d18c6e2
SHA1 9980f99309793f4c94eed6502828f68fd00ccf16
SHA512 09a40465adeef20833bc788228d1696406b13a6ed8d19dacbabc2b39eb49a8f8b6ff1279a9ea88c4c8ce18e00f6067c52de27abd2ad3e63e3681f1f7027a1ac2
SSDEEP 24576:uEPghm6/7IIXdwcXrif7qQncjlP65i3Vu4sqjnhMgeiCl7G0nehbGZpbD:pg06DIKdwc+eQnSt65aVpDmg27RnWGj
TLSH
T123955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 1ed03d7b5cc2ce72c97f9f0a1512fff341e7f2bf2fe532ccb4a44ea83620dd68
MD5 7bfc27c1880fde8b97d24197bbf21927
SHA1 d1cd87d382714481426bd2bcdfc6fbcdb840ff44
SHA512 ee8c076688cfea3540e0f0df63238843b03324a6bd14e0225998071b45aeb837edd362bfd05b625a1bad77ccce575476aacd0c887421c51f6b24902ea7e720e9
SSDEEP 12288:CEP3RnHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BnHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16955126E679C60DAD136907D8291C209D773F4716B2127EF26A2C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 9a8f2df1bb7aa8745ebd7539925aa59d9cee34f76ddbd8e411d7614bfec8de6e
MD5 ebaf7515b57517b082facfb83609c45b
SHA1 ac5b52191e6718ded1fef9695bb5fbb48ea31b97
SHA512 807e78ce1b5c2e1c4702e551492c68777b1f225db53b9aec46524b5582eef4f189b002bf6449eadbfb29537dce41d3450d6b854eac6cb2132725f233651d646d
SSDEEP 12288:njkyQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nIyQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A551219639C60C9E9760578C6B3D1589C36BC31AF2042DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 31c4a8df9ae6c1af0a9878d2daacdaf7f6597b7c3b459ff7131da8792bac9650
MD5 b2017bd182fad758cda76924f9767d80
SHA1 465320476b3d9d8f027ae42dfdd7c1f132cdb597
SHA512 9816379abc5d8e985bc080b14532d5a74572a564bd8e41662a853db3778a152aeefa7c7fc9bfbcb276c3ef60c63a2ff031349ed28a558908971f874bb7f374b7
SSDEEP 12288:IyWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B445237E525C60CAE93645B8C3A5E11DA8133D766B2014E739E3F8BDEBB24D44739812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 87815f3ee6e5757a2bdc569b3eb2bc2bea465e8fb97db2044697117ac3884a58
MD5 74e1952efbd7f3d9151ccfb08be28af0
SHA1 811ad64bb84dee28b0e79802839f6fb37d66ffa5
SHA512 b04a6c6bc72870b3b8062b4caebf32661721f276dceb8e9b92e3369e656dd1a31bb73a83da2a8b392031926f70456ee404125a978325b02bd517997b6298f37f
SSDEEP 24576:VQ9MxZKdcz9dw35sqjnhMgeiCl7G0nehbGZpbD:VVKZ9Dmg27RnWGj
TLSH
T14A558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 62d66e4f71043266592a85415e19f22d6e74c58a8817c2b6a39079aab9e7cc45
MD5 fc4d1accaa709fc80161e3a1d01bf436
SHA1 40efa946863e23c7e983b2437211fe4c1c585ff5
SHA512 32d0133b33e3b69c5007d1b7986851559c510df3c9a4e191244d8f8d4b97466ba5bf42b1f8f9255f7c751996ce3a3a803c5431129457b4f2afb46e3c515e6d2b
SSDEEP 12288:vyoKo2JRple9p8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:vyocDAp8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D65E01FB76D40E2E176813C8985C249E673B4305B6157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6a006af2dcf5acbe1243a7960c98c64125b21caf2459f3ddaceffc7359d78d9e
MD5 12a3458978ac197df45f0a26ca032e2f
SHA1 dbc934f851f26ba0cb62a3e430bc63802135e250
SHA512 2eecc4e93dff049616ac924d19ee51c945601ee190b261740c4a5ece15239a2e55284b95c7446518724b53b55004e06f2c59f9f14832c8e0b6cc1dfa5e3e1ecd
SSDEEP 49152:VWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKoDmg27RnWGj:F0zuNIeD527BWG
TLSH
T198A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 91b20d48330db3bee8851c663c5fcb6018c5d59636ae27436c2e867a0aeb1f22
MD5 f921b8d4e55a70fb4d25e30135cbf61c
SHA1 99e4a59b4555d0eebf3d3d98914079b8ca5480bb
SHA512 833a9da0f40b106740e96cca778d0c2f62b95a6401f12b7e5956c322ab5c9a230ce8012020dd53423090a38c114636273636d4ef2716da6b1f74ce263f81f9a7
SSDEEP 24576:x1QT7EcpfxR+N5AWAz3ooiYtjMqbHsqjnhMgeiCl7G0nehbGZpbD:UTDxR+N5YzTfjMGDmg27RnWGj
TLSH
T1EE55B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1864-409-0x000000000C970000-0x000000000C978000-memory.dmp

Download

memory/1864-386-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1864-402-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1864-331-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1864-481-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1864-370-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1920-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1920-34-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1920-40-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1920-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1964-408-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1964-290-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1964-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1964-283-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2016-259-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2016-252-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2016-253-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2016-317-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2032-17-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2032-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2032-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2196-404-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2196-280-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2496-234-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2496-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2892-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2892-314-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3224-273-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3224-327-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3248-330-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3248-405-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3248-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3324-313-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3324-477-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3468-412-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3468-306-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3884-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/3884-58-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/3884-8-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/3884-9-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/3940-478-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3940-319-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3964-263-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3964-321-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3964-269-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/3964-264-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/3984-237-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3984-82-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3984-84-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3984-76-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4144-480-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4144-328-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4200-449-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-413-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-435-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-436-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-437-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-438-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-440-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-445-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-446-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-447-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-451-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-452-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-453-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-448-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-428-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-427-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-426-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-425-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-424-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-423-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-422-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-421-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-420-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-419-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-418-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-417-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-416-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-415-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-414-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-450-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-429-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-430-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-431-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-433-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-434-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-432-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-439-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-444-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-443-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-442-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4200-441-0x000001EAAF8E0000-0x000001EAAF8F0000-memory.dmp

Download

memory/4260-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4260-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4260-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4260-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4352-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4352-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4556-295-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4556-303-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4556-301-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4556-411-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4576-479-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4576-325-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4764-245-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4764-312-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4852-74-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4852-72-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4852-69-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4852-61-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4852-67-0x0000000001510000-0x0000000001570000-memory.dmp

Download