880e1deef0d02f0280e6b8652636d16a2ef38813b4f1992afa66daab6800e21a

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 4.1MB
Sample260825-apy7ysdn5v
SHA256 880e1deef0d02f0280e6b8652636d16a2ef38813b4f1992afa66daab6800e21a
MD5 d18ac8bf8160e9e1d2a6acd36f1a63ed
SHA1 8c02c6a6bbf3b3a8f2f9dc79820a05e5d8837bbf
SHA512 ef1187e25e4640e344fbfb8bc756ded43a4e228351bfc64419845fa77ea282f567d5ff8c182bd990885b8be6d247188b32bd7ebbb896fd89e112f341dadec9e1
SSDEEP 49152:5STEw7JU7QkgAz40a8AzyRoB6NYhuqzgITFV8SquBRhc2A3ue5I8U1QqpN755Uaf:WEVq3FOc5Pix8EVy
TLSH
T1F3166C2EB35845E8D5A6D5BC8A468506F271F841CB2156CF22A4875F2FB7BE34E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
6012	alg.exe
5128	DiagnosticsHub.StandardCollector.Service.exe
4936	fxssvc.exe
3824	elevation_service.exe
1280	maintenanceservice.exe
4888	OSE.EXE
1692	msdtc.exe
4304	PerceptionSimulationService.exe
3292	perfhost.exe
2296	locator.exe
1744	SensorDataService.exe
3956	snmptrap.exe
4432	spectrum.exe
2280	ssh-agent.exe
5620	TieringEngineService.exe
6048	AgentService.exe
3984	vds.exe
760	vssvc.exe
3492	wbengine.exe
5344	WmiApSrv.exe
4592	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\47a3e4f75a3b5d25.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6bed64a2834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b81194b2834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a18934b2834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2af854a2834dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a882db4a2834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009347e04a2834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5128	DiagnosticsHub.StandardCollector.Service.exe
5128	DiagnosticsHub.StandardCollector.Service.exe
5128	DiagnosticsHub.StandardCollector.Service.exe
5128	DiagnosticsHub.StandardCollector.Service.exe
5128	DiagnosticsHub.StandardCollector.Service.exe
5128	DiagnosticsHub.StandardCollector.Service.exe
5128	DiagnosticsHub.StandardCollector.Service.exe
3824	elevation_service.exe
3824	elevation_service.exe
3824	elevation_service.exe
3824	elevation_service.exe
3824	elevation_service.exe
3824	elevation_service.exe
3824	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4576	2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4936	fxssvc.exe
Token: SeDebugPrivilege	5128	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3824	elevation_service.exe
Token: SeRestorePrivilege	5620	TieringEngineService.exe
Token: SeManageVolumePrivilege	5620	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	6048	AgentService.exe
Token: SeBackupPrivilege	760	vssvc.exe
Token: SeRestorePrivilege	760	vssvc.exe
Token: SeAuditPrivilege	760	vssvc.exe
Token: SeBackupPrivilege	3492	wbengine.exe
Token: SeRestorePrivilege	3492	wbengine.exe
Token: SeSecurityPrivilege	3492	wbengine.exe
Token: 33	4592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4592	SearchIndexer.exe
Token: SeDebugPrivilege	3824	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3580	4592	SearchIndexer.exe	132
PID 4592 wrote to memory of 2888	4592	SearchIndexer.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_d18ac8bf8160e9e1d2a6acd36f1a63ed_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:6012

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4616

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3292

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1744

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3956

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:6104

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5620

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3580
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6ad0dcd17f067b14913c574b8a64011313e75bf98f6cf4ca08672bc6f5bcab19
MD5 9034df9c54231d442b61ce05a069cdef
SHA1 4f47e8c749a5930d580602d5c6e1d89d48d0587a
SHA512 0de079be0d0788b50ad942b895ccd23aa84e3a1fde722c2b4e01d3896373e71e731b18ae0e017502e40fee72847750a87a0011cbe18cb7d1eb06ba5fb1ad7da3
SSDEEP 49152:jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8x4x8EVep:B3q6HjBrix8EVy
TLSH
T187D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 944004314cf1ab6a945ce03a39164b706af585f8e03dd2ddf7bebad9d009f30c
MD5 92560e8ee6245e88f2eece083b2c4c91
SHA1 fe8bc8b7c1f09ad905d0dd77ff719a104ac7e667
SHA512 ae3b2bc22e0aa75d793e761373589e899d0d1e5c3479e05081f2e3b58536105e35128747ab37dd0fbe09f30afe1698c8d513a250e0fff4c6f601cdf79e7bea02
SSDEEP 12288:U1XLsswWkxy2lRq2czAU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:yXYfDtczAUyxknw4FYnshx8OfVe247
TLSH
T18875F12877D508F9EC6B8139C9B28512E633B8954770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 dad9b55dca0ae24db341a609ed534218b335cb7a59c8b8be669ab8a7b1da9028
MD5 baa71ea9719181c1c3da7da9763395d4
SHA1 7bb4f1f907c5ad9bcb68a588797efb5386b3f671
SHA512 ea00ad882ded5841e1baa58bb1fbc56a7edaeaf25ef52ff78ff2d17ca8235fb606085d0d50f8d3c650d798a1d39c7c9e5254046ad17af9634493dcc0631d9958
SSDEEP 24576:80Le5ji0hmx1rMhyxknw4FYnshx8OfVe247:8Pji0A7dx4x8EVep
TLSH
T12495AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e06779fe3aaff57412fe95f3f3b000fbc6596c4138495a0a655def5cc96a8fb9
MD5 eb0a3fe15baa9dfaa2a6131b10f46d5c
SHA1 01c055b5363af08885c77cd82f271cdb58bc56e1
SHA512 395209fdf0d9bf9f1f740ab23916b5ae2f97dd94a3daf9ad6372d8e66ddee77d02658dfa5616ffe1c19b1a6ba47933a9dabf3df331e9c0d3d1ea7b48108e0fa6
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWE6q8wyujyxknw4FYnshx8OfVe247:o/ezSC6vUzPvxHjyhx4x8EVep
TLSH
T1FE756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 994a7e8cbd65c9b3d3df20dcbf4496f906edadecae70c376ae423a3b619d633e
MD5 106f1018dfe8e025feb8260412aa367e
SHA1 365945dbc98262a3921dae0adfe3dfd16cd9a19d
SHA512 56d9839fbcd1f2fe60d8b197cfd594baf3855e8f87a7391ceffdc049d018d55b258f65629406f5ef1e621ce1859a0a10cf46e1066b459da6dd58699d9aed5eb0
SSDEEP 24576:YVbqPb88hv/l+64yxknw4FYnshx8OfVe247:YVO88hXl+4x4x8EVep
TLSH
T115559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 fc05b2980ddb22648fb16dee3ffef1d6314c21b79f6d825dbac5b6442df6b90e
MD5 520f3fc3021488026e4931856326c5b1
SHA1 f72befd2a3d39e0bf66d9d946720afddec275476
SHA512 a279338c3762c91cdaccfd500168867a757a7cf2de72d0af6723c36aaf9f2340fa23a40c6af2555fc77ae4b5c30ca6582e248af08306dad331027a480d5a1b24
SSDEEP 12288:RNl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RNlyxknw4FYnshx8OfVe247
TLSH
T14465237CA7DDA4E1FA9E14331B7572622616BDA0DA74C11BC779B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 57cf86b0078f4a92bff92a3f0f7edf6047b8c827e67484b98a1af83984f78071
MD5 8cedfb83d84e00e6cf50f739812793b6
SHA1 40f9ba70aa8086d1e6118368f982733efdd8dd94
SHA512 49664273668b2ac358989d5dbfa649da172bc6ff5ec516d19ab336ba4be24171225f2d8bee5697bf1c1459d5e8fa076c07ae7e6dc024b39d3812aa76a5d95eda
SSDEEP 12288:ZeBNUbTVO86UA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZJIUAyxknw4FYnshx8OfVe247
TLSH
T1FB75CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12098f37d8d9909ffc4a4d4c7e13fe543b5e146d977eb6d2b3683d47c8415ddf
MD5 5a4cebd4cbb88fca115345ab76950333
SHA1 7165b05950867b3d25d3202c216b728ebf35bfbb
SHA512 136a017d18e09509643df531353ab6162312639f21e2bc62bc704ce13d2ca2d13044d01e957a3ca8379418ee9a93ffcb7e23de837ab2642ad78bafd72fdabe00
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:IQvGAdlCEL8c/yRNw5CWix8EVy
TLSH
T1B2267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 ccb20b801299363fc0dcaab6b6a87d1ad762fe06bedd710e9650ed854afe1b36
MD5 5153dff5ceca6eb6c8549d2bb1095e4a
SHA1 212fccfdb7465bd1d0fc7c00c65f746d97f5b828
SHA512 f2e62c86559bbd3dafe8fba31eedf02229d48fa0ba03125bce32c38c776eda83c95e38dabf6f4ab6fba7ca7a7c68f7b520b327a77a75acd6ce3ee980f0916a7a
SSDEEP 12288:MAwSfxL/2Dc3LDLLmt0LDQewsAjS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:x6ewsAjSyxknw4FYnshx8OfVe247
TLSH
T16985E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 49c41dd96e448f08303102b8c2d4e2d87c921a821a7d3f18157cf264bb5ff190
MD5 6c514593372bea206629bd42aae99df0
SHA1 09e7908c07ff4b2462fe6ae52ae2c272676adb01
SHA512 d523c8a6f5f4868553aac3b66d5ab79ea66903bc4c60a9892ffec8387cb33b487fbb31243ee883723cbaedfaee33134e86f28b2b8ddaee8da6ccd58b637b80e3
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHI:aUEtQevvqc2W1cpV2EI32
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 32830297a01876fa19ab17e3187baa72ba5a1724b07c47f574c8a02c28ea6460
MD5 4acfd06bc7a30cf82888d10cfd8a720b
SHA1 fe516324b999ba13e20d488d6deaf25697dded92
SHA512 5db91061ca1686a7f031cb631831d4ccd8347c07a79795dee108689a8d9a0d2359d611d350e2072386a7c681ecab3d67e7fb362b9f3cf2384bb531e7bde1d12d
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/ztx4x8EVep:voqtVjnmaix8EVy
TLSH
T178D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1ee2f5f3a78fb3e79fe32c56af6a66176bf5f0eaf755b3dacf3627de75ddab48
MD5 01e2e6dabff115d6ee03562d3f637302
SHA1 d879c2d58ce8d6f3b9dee8c8086472e41bc68860
SHA512 42a5b83a7f33faf4c80ff84f869abbe0c60da0894be09b269dd65b1dc420a281c8e7de2f8d5dbacf1e4be7808289fa870fa273be90e0ad20b3bad95ffe15abc0
SSDEEP 24576:iAhGLJIFoiwtA5l7S53Pyxknw4FYnshx8OfVe247:iAMyFoiq5Kx4x8EVep
TLSH
T18C35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 b456011e0156518a15db25ef1335ead4bc281956803110cb514c884a3197003e
MD5 271fb23815ed8cb6c68e77b3c0c11a52
SHA1 6433d0eb2fea8299a446ff15515d4222b71b0f16
SHA512 4762c66748973e32bbbfad63849527e5a4a0facf4ed7a4653abad6f1b437d27a21c90d4e3faed0d441eacce54a073ec332255ced0b2d85b68f06b5d024a1041a
SSDEEP 12288:Imw5HEjsChN4BFgl0WDm+CD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:lwuVOWOyxknw4FYnshx8OfVe247
TLSH
T17A75F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 bd5c33596bb0dfe9815073ef4f53875fbb2a6c27441b160366b8a68ac1d16e4c
MD5 c664e3e03901d419f702fe639d92921c
SHA1 bacbda1f7c30ff58c7334244d901025cee191c18
SHA512 e317c5cac160d3083a541263f4dd641eb21e71b7a538a2f29b52534fdf17050eb9f5dbb33f81153e055a4e3b467cea7178a1ef531b5371d782f728c32a272b98
SSDEEP 12288:kFZ1IyC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:GZupyxknw4FYnshx8OfVe247
TLSH
T1C56512AC33E860F1E1A7113A89F15206E76274A2677183CF4764625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a89728ed3ba14a1709c00bb4cd4b33974648050839d098c34aeb0e9900769ed1
MD5 1d9c024b1ed238d4f8426b1ec8f18d21
SHA1 7eb3bfc73e44e29e805009bad6a690872890e8f8
SHA512 5e32cf8e28785368ec2e08742528b73c05edf34e5ad0d8d68e7d0f9f28a826fc2b3c9f3e6f6261c9c23c7324a90347e98e1857b9b97f332161307ad155d38af1
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:aQRQyi36YOcPQLvw2gAf+PN33ix8EVy
TLSH
T1E8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b679b4461140d5908d5db0f58d826c84250df0b8ab507299a58f929bf915d718
MD5 7b28d4a2559ce23323da1faf1c0f178a
SHA1 0dafff5e4df46a126ec89e563022cae5edf9ce6f
SHA512 4efc97932ba3e7b34bf222c7bdb3847b1e33ef51f862c3d0f0c36a87925d47de3ae2f894a94b46971b103a39699b8df09b62696ec764771a197a9ab3ac058e7e
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:xQRQyi36YOcPQLvw2gAf+PN33ix8EVy
TLSH
T1DD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ed79569e9b6bd21052dfc316255d40596de0e85c32c305ae5ead8b5b7b0a7958
MD5 d086ef26ac8d7cb11c31ff743d8fb337
SHA1 2b28c122b872df6ceddb67b240783d6ffce13924
SHA512 0631750b924f20fc436f36aea65a1d68d27d43f4dc6632a0dd8b79daad47e0016245605c0524ca2d61664639ded3d919ad44c7f2294a1818831b6bbd40f379c0
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL05yxknw4FYnshx8Z:i68Qg55nhheWu7PNU3/dx4x8EVep
TLSH
T1C3B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 507e79fa7be68d2de699aec83b3e2261c49a93d1f6523a2cfa929661979b9cf9
MD5 9b88b48fcad9cc6da0fe186d30e09b1b
SHA1 3648854fa0608b9dd994bc0c08cca5704b688f17
SHA512 cf4c0ba876aad5259c281a5f524757aa1f21be53b0dd67a00db9cc51f938f6e00938ffc59591ac7958d3f48bc67b5f573c9266e0bb082cace86e0576ac687181
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:Sy5112gYy5azzVvL69nLKnhZwix8EVy
TLSH
T19C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 62947421ea1e6419b8284e5881918c223793e98ea0928d38ac923633e7e945d9
MD5 722dcbbce43558c9a672decd2a88f6b8
SHA1 3935201b383f7b0562c30208342efcdff989dd2f
SHA512 679fb14e486df646fdf81d76d30242083ed12fd08f06f304b8e57e45b694baf5586fd857f21542f9a968350e84f52411762c135be85131d4a6bc1db65ef22e02
SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllx4x8EVep:6u6JmVxd2dlix8EVy
TLSH
T1C4D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 71fae4445ef3fc626430c4dd9776cedd2d3a2fc03e784b21a46f3666677678ee
MD5 09d083f43bef419c9235edd26ab8250b
SHA1 65420e6876264264945071e0ddb5011b250d4856
SHA512 d66bb2a7d52c182c15bf0f4c84e6405a4dd493ebc316f3c11a53895e708dcd40ba8bfa6885de0a8699077a1cce14553327755b357f4e5a9d9a0cbeb04190f91e
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xjx4x8EVep:MmifPbRaix8EVy
TLSH
T1E0B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 573da7e797496cff132949cd5cb9d1e7e6b92b30373df7e259c6937ac4f38e07
MD5 3de36fd236a692c98ee515967b1031d7
SHA1 d579cc2a119b042b020b3f46359d433d5de44e90
SHA512 6669fe5f8fbed64086bf7c6dee731f13b57e1343759a2b753ddc27c12fd77ff0b11f09daa72c9238ca361b671c00083fe2294729024066e47cbaa1d61f9deb0a
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHqsx4x8EVep:U5dKTi61six8EVy
TLSH
T1E0C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b713b106345648354081b96697ae35684d5a9ade25ef6c92ea3b041980f0873a
MD5 00588871098cd16aa1e682e88d2b08a2
SHA1 88fe0a0fbf86d3859f857060a88c38d3940b7c30
SHA512 9660e5ad7a5e89ba8a66ded2f93cc82447007f9e91416f508619065362d3e5e7a7c12edc6e97521558dfd7ea2600832815d86c8f8feffbb9ebefcbfd41cf1968
SSDEEP 49152:YhtSn8EApI0figngiDn0AP5wvx4x8EVep:JX2iyphOix8EVy
TLSH
T1FF95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 656cce653fd76296f672fe2ccc6a8a56cf22fbafa0f0b4feeaffaf5ef59dda30
MD5 a31f217399d7cff21f72dd35d4510078
SHA1 f6a0fa8492f758862a3edc9fb6e9f6d5ee0b6658
SHA512 797ab3676d8ec84c399fcc8919d90e7bacb02dd9fc4252699613379497d6fe498308f00f94e749ce1d6c0063c2863d86db6dbfaacb97ef973258b0a5d611452c
SSDEEP 12288:8N+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8Nyxknw4FYnshx8OfVe247
TLSH
T1C665237CBBDEA5E2F50D11734A7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f22a0e3d0223ab96fd9669a2432a8d05a76e1278fcc32f065347ac8d2f20d982
MD5 778c5a3b89e2c872b6f536ede14c8851
SHA1 2860f8516bde391bf3181f55091076ec2f3fb595
SHA512 7a0fab6c0d961e789c547884dfb2c11eca0396e55a651a38aff8299f565f295e3bb13cfc4cc06f27f56da4aef4a81ec594abbe11327a0853a27369536338eb1b
SSDEEP 12288:Em+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Emyxknw4FYnshx8OfVe247
TLSH
T15B65237CBBDE95E2F50D11734B7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c8e71d88e311acf85ca3183ebbe40412a049019c944a4e4cc5e7f9d4975c5113
MD5 1c921b95f0dd03196e3128779e74bfdf
SHA1 0dde4558386ae186097f8c7e4fa917ccf06a5f78
SHA512 0eb51e2d83c142b78bf635f361029b86bfa8a1ce4fda16b8da8ded1ec140ef7d26b160b95d81fa4fd4e3d2e1670814bf5d6034c969c527f4e309ab46940b4857
SSDEEP 12288:nI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nIyxknw4FYnshx8OfVe247
TLSH
T12765237CBBDEA4E2E54D10734B7173626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 381401f7a02951d9f1c50b976d4be4da061d11d36c26449102bffe6864d91162
MD5 1298d48dcf18caa6c18259974c4cbe56
SHA1 7e765e849eeb094d827befb3ff813a9cc94721fa
SHA512 513d33dd1c80d7f08af420f2f7d3ffb7e4202e697f498cc623fd085acd784609886148e6f0481181e8c193a97f6733d9da2c4ab09a37cb2a81933ae5f4beb8f6
SSDEEP 12288:CVv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+yxknw4FYnshx8OfVe247
TLSH
T10365237C77EE50D1E85A51738A716222B365B8E5EB31835FCB24710EE9F0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2221825ea0c484c04d0048350b600da9743ad275f461d0659c1b1a7edcd27435
MD5 6fe2d7ec6c6f7b1e6acc8371e62d6a16
SHA1 0adc2241963feed76b78623c85de7999c61c7df4
SHA512 33f4662e8c544e0dfc5418fd84a0331158a01edc6311a6107a66da41e74477d75d59e9b04f4a1a9915f9d64e5b5af14794307fe2d3f14297265ef85835252d9b
SSDEEP 12288:Bn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Bnyxknw4FYnshx8OfVe247
TLSH
T1ED65237CBBDEA4E2F50D10734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 7c2bc546efe4fc561033a03164e59e2c5fc579c361885b8c45f7f3fbd88692b2
MD5 d0c5f2e41ecb712e0c31bbeb293e86fa
SHA1 64e5ccfa8376acbd6f1a949b94a35d5b2d2fd64f
SHA512 c22b503e08bd57ae615875270fe7ca179dce03bb50f636e5c10b13aa025a76085dc381a6bf38b70a97df69faa8dfb97955d33e7449af738b225c73bae4ff750e
SSDEEP 12288:36+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:36yxknw4FYnshx8OfVe247
TLSH
T13865237CBBDE95E2F50D11734B7172626609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9ddd4d8db05b5ef366bc9f56577eacc4424a0c5ae164d8bc8f9abef9c0f2c29c
MD5 f4015b896ee7a72d998bea79b170e355
SHA1 2fb03bd5aaee93092cfdf6adf359af3cc961e739
SHA512 07e3bc89475748886317bbbc6b69b6be0b188cc2a2611d029dbf378b92b6a52cfb2e2d1435ceefa236d180b0c79d9be5344100164dfcfcdaee2ead4a1595908a
SSDEEP 12288:ce+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ceyxknw4FYnshx8OfVe247
TLSH
T12C65237CBBDA95E2F50D10734B7173626609B5A5EA75821BCB7DB00EF1F0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 7dc36e13fa69515c27ca64388f083ca35ea48f112fabfff39c4d649683b8128f
MD5 04ffa355333edb34a10c600298a2842e
SHA1 04d5c6a827de44f94f60e3a916505d6cc01ec086
SHA512 9c8a2c6b54c41e70a79ab292c399c2677c3f613f25325a1ac88e7c5a6bfaf33a4bedac21c3f34f66fceba00dc434e419ca9f43404549d0b571353599e29b1506
SSDEEP 12288:oiZwbZzzFEoS2cPvyG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rZMdzFVSOGyxknw4FYnshx8OfVe247
TLSH
T1567502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 97f03ac021f5b967005de65c0e1f7da5564d73a77e19372deab6323f21ccf7a7
MD5 5de2eab2032395b6015e41a52b624d93
SHA1 c41e0d383f9783de85a606314ed89e5862bfef9e
SHA512 796ea5f434fd6184312cf320f788dd7b6c92935b9149a909b6e6670fefd121e943250adc06bd0fca06cb623d0aca390ebaa39c9fec902c9dd0340acdc980fb3e
SSDEEP 12288:6Z+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Zyxknw4FYnshx8OfVe247
TLSH
T10C65237CBBDEA4E2F54D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3ef39880f4e064d1e04f092c92d343e496d67c58208a7460d83a6b39e72525b8
MD5 81d6dfabe58603f0995dc02a5d5baa29
SHA1 6c770f02b002cd0aa217d81274f952cb8df55c92
SHA512 88b2e50121bc6d72ae7325745d636bfc66dcff97ee8b5cef8b37a7785caa675daecff1b6c6c98f6adbb05d230deb8feb56235736d74cdec1c7ef8023ecf4c2bc
SSDEEP 12288:HV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HVyxknw4FYnshx8OfVe247
TLSH
T18E65237CBBDE95E2E50D11734B7173626609B6A5EA71821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 ef237b5514fb56857af95ec8c10da16208097f230c6e961f29df0166171d2ae6
MD5 f383853d012fb3f4c9820ee579a12fb5
SHA1 e502e8bdbffc1f3706395610382b7243dc5100cc
SHA512 6621a996d313b5658b8a2b66b817cfe3ac98b295323841e3d002832da9f9b561d3d945b17eea95b6406c2dfe42f7ff37896d09dc12c6f8ddff3b6e15905cdfa8
SSDEEP 12288:uyPz5L8C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zzyCyxknw4FYnshx8OfVe247
TLSH
T19475125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 99f2120486a0a58129b55e7d68fd91657ebfdaa2d9f59dd9072127dda8827cde
MD5 e77b8660a2b1a8446b3c8ebadce9c406
SHA1 3fc0b78003dfda62af9dfc2c1c5691e8ba54baa8
SHA512 be8aabf56b43ead6821cfa918274af0e5b40644fdfc48d7b3949acb41d9e1e140871ae14920e5a19642d50309d3fc6e3970e43ea6070ec920aa386018f69d683
SSDEEP 12288:zZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zZyxknw4FYnshx8OfVe247
TLSH
T17065237CBBDEA4E2F54D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 6d4c2565fd08dcc74af099909a65c9cec1421d13756181c0a09a7e058d26ad09
MD5 e10ad79dc44af2ea0d3dd1a11372b4a5
SHA1 18ebaac4cb82edaf2ed58cfb7cdad52df8f1bb55
SHA512 1ca64188649a736722406c8de60e88f7227f3029d46b505ddca9723c9fc3f14bb3ace9e74ce2440195f78bd8775137d0693e2ce88d9a2d70e42d40e9484ac077
SSDEEP 12288:zZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zZyxknw4FYnshx8OfVe247
TLSH
T1CE65237CBBDEA4E2F50D11734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f58c30390c14e9b3d80847a4ccb5589929b3bea31afb919c0f00e7e1cac50c28
MD5 bb32ae8607b55d72650b1eff65a05eb0
SHA1 c0cdf3b9cc1560ce8aee573693c8730c2d042cd9
SHA512 b51e3e405a9dc9d46888987d467ab91e920cb61f36fa53a9a12c7ba4387733c4f58d340b72157ad99ed9398521818cc99254fde91c29e5d0f7e4eda1adc21005
SSDEEP 12288:8yPz5L8C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lzyCyxknw4FYnshx8OfVe247
TLSH
T10775125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 7d1bcc9e98ffd47575260834fe83b2601e8bb8b9eacf4943923822a43ae548e1
MD5 96d70db9e1fd2ae783415a6315e79572
SHA1 6be36f17c6e185bdb829a6a03189ef6981e65d21
SHA512 9ce8debc6ef15e75bb3a8b6b94da8dc7ac3bda77603c495cfe9a2a8a19cb7c703ac15e05bbd2dc074d9cc37e5ef0d2849b234381a359ae743f3497f68976fe25
SSDEEP 24576:hTGaLl3z0zDYyxknw4FYnshx8OfVe247:hTFLljmx4x8EVep
TLSH
T11E7501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 d7046ce2e6287533d97377c27c030bcdd8094be47b4f73e5b111959e504d7034
MD5 3189b37e18f14ec7bd52fcc92784716d
SHA1 d423150b180c3ad1769cb1b9ca8545c5c8702c3a
SHA512 06a074361d6686091402ec5c8e609951c94b8d1cf1c8d3c227d883eb1d1025106f887552fb05db54a4384ce8f8ab2447f92c26901aa6fd703f3c20803a886e60
SSDEEP 24576:s3Xd9CHKy7GZ8yxknw4FYnshx8OfVe247:WXd9CHKyaFx4x8EVep
TLSH
T16995DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 071203da44f94f26aff484021ff20ae64b33687023dad98f94d0b60717632dc6
MD5 feefe188da33b43cd43ee292be067642
SHA1 10ed22d772d7189f8c89dabcfded05b2ec83aa9b
SHA512 5ecf077fa641eaf347a2a8c7fa6130a95eebee14913f4e0c80a98c195682b5fabec223daa7e763c4cd4ccd8588e57d3be11a239fbc4267ae112a2edb877b2bc5
SSDEEP 12288:mo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:moyxknw4FYnshx8OfVe247
TLSH
T17165237CBBDEA5E2F50D10734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 d375950655e0eef2ab5a445bcd5191b5431c0adffe1dead0e89a5a3e184fd3a9
MD5 ada801b72cc123b34ad71e0ff6d4c999
SHA1 141d12831552349bf5533736782cd8d3f2c3d1e0
SHA512 1742e522d8b54611d0775f4a8bd2e581e9287649864dd568e76ff1b0d237d15b3b75e59c6a851330caa56ccba31eb192890e0b697d7633b1cb9c3384c378d3ce
SSDEEP 12288:/i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/iyxknw4FYnshx8OfVe247
TLSH
T16365237CBBDE95E2F50D11734B7163626609B5A5EA71821BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 4c3eb1fa0ddded65de0f3701da4c6353be4a1099b1b2b256b5dfcdb0184496da
MD5 e1a67fd6aa0b4ba693afc710e453c583
SHA1 9006ba82ae5f71df5a218c97e012160b37e91315
SHA512 ed1bd8346856066a86b83519a9f0b040ae11e8986095b13d3ab8b949593ee5086af0b6a33bef5712acf4275b40b66202eaf5f0e0e339fa696b050b76a2f29b07
SSDEEP 12288:Bb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Bbyxknw4FYnshx8OfVe247
TLSH
T1C265237CBBDE94E2E54D10734B7163626609B5A5EA72811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 9b0ebe150bee492b0c64037ea7bc91dbb5d1a3b214471ae8339ffe55aa51d00a
MD5 fd7912f617c1dd20adc1d6daef11fa70
SHA1 6f1c58577ed1d23a24927142c5463bb50c141713
SHA512 60c8c30fc906607e6c149bb42ab396b524662ae9acc39382a7157106583f699233d9aade9a90a05039713d940a6ca41af16d46f432c4a8dbe56f9a64fa1249bf
SSDEEP 12288:F+sfp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Tpyxknw4FYnshx8OfVe247
TLSH
T17575F028E29842E4D06E2176CB625641B3237C6597F1D3CB93E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 3320757d7995288200f827528300c03d94c1a66688ae0ecaf00f06b4c7c5eb69
MD5 cd4f3cf1d10744c8828c44cc0d92dba3
SHA1 c29713f38b9a0ff05053e276ea92e02ea5be51e0
SHA512 b7e666bde5feb5d0a83069d735a63e7e0e6aadae7a89d0f1f5ab7f7210e9a4e7aa24a37e76e3f197fb0c59afbad6569836254c93aeaa9cc151c7377616f32daf
SSDEEP 12288:qy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qyyxknw4FYnshx8OfVe247
TLSH
T1D365237CA7DDA592F56D15730A31A231361AB6B4DF70C14BDB68B11EE0B0CA0E83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d4e85a1819a4c88a5be23dec1ecc8c42928d0b4664ad799a540e127d4231e787
MD5 ab07db036bb3dcf01c12aedb0349b416
SHA1 985025f32c0e42c25cbaf4368084ac5222440b3f
SHA512 36c386d53d2d2f0a37e1ac408168c2c5377a25a943856202fd2366acbdc53f1f9db728ab207be1d4376fd61d58f2fb9347db14e296d353f3957bb79e3e00e696
SSDEEP 49152:8a0h2GEkuAe73q3pp46zwwQ3x4x8EVep:8a0hNYG4JwIix8EVy
TLSH
T17D85AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37DE48E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 5cfcc5b1e67eaea0fa49e2bc93c3d281bb5f2f15305b0517ffa97d373cb4ef20
MD5 32a6a497b244a95a7c3be9cb2b7bf292
SHA1 a67ef38472a06b1b4960e359ed0361ce6f13cc12
SHA512 3eb47f4a17711872a0e5737ffc9368a9c2817386474ec86e125f77fd135d3afa0ab41d15280fdb8fcdc14d5fc0d84e12fcc3155350c5a98907b9fc575af0dd2a
SSDEEP 12288:ohbHjfXY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ohbHjPYyxknw4FYnshx8OfVe247
TLSH
T1CF65117C27EC20D1F175A17A86A28206D331B8651B3193EF9395923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 fc51af7f584bfcba56d0e064e292b4575a8dac0ef5340cbe37a47fddd99a687f
MD5 c9b33e547440d2c194e71c1fc69b2865
SHA1 b3f3781f05d3804f7cb581f2a695ed49afa23b88
SHA512 b2b9597cdff021f759c59f6ce462334630756448e0364cc8a75b195d163a5d72371176b03acaa5dcde6aeb55a7951c68206c4311d7e00a0a30fcc7f9cc1480f5
SSDEEP 24576:a3YgnJcRTk4yti+R5dBR/wyxknw4FYnshx8OfVe247:aIgnaTk46pBR/zx4x8EVep
TLSH
T18F45BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 594ae27159688a832ec31dbc97cce6fac667ca3a1c6506281e371a183eaf9e04
MD5 fecd9c964298dc9493a1b343851bae7b
SHA1 0bf817218d04dd0ffa6af7965c95ae82d7600c91
SHA512 06f8fcf17ea3ddfcd16247b32dc127d7f889c9bf932a2fa35e59f8e177cfb5864a16c33b5afd2d07c6606a71b9cfe2042c552d1c56935b72e0e239af34544590
SSDEEP 12288:mu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:muyxknw4FYnshx8OfVe247
TLSH
T16165237CA7DEA4D2E55D15730A7262263605B2A0AB7182DBC77DB11EF1F0CE0A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f8605154f7b231a648f3426c416a5c9cded8ac298f2824fa92f9962d815a4af4
MD5 57356b8330268275bd8e3e9260837619
SHA1 d119f6edf21b56769ce068a0aa2660264bdc19ea
SHA512 5ed05c05bf1de6818d76a0e26b2148c3a48eae88c41869829e5188e0f1ac37b784807a5f520651de2f898d12e5f27aa06deb0f76512694a6c8d46aaebd5ae026
SSDEEP 12288:pOb6A4LWOsvAYFTb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eCL3UTbyxknw4FYnshx8OfVe247
TLSH
T1BF850158F7E400F5E86B813DC9729612E272B49D0774E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 67c9bec6bd0ed6b87ad343c38077b099d0d5880af726af389a220d11ef256700
MD5 3b76c9581dbac1588541769e9f20188a
SHA1 741ea51ab2a1fde500db9e40bd19882796c62fb1
SHA512 f9b54a860d3671b7fe54c509aefe199640f6a56967ae44ce3dc12a44732d44e08fff10c72f08dc92f7daca90b84976b914b8f4b8eb12984ce12a77c8a69b0a4b
SSDEEP 12288:WpFtkOH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ROHyxknw4FYnshx8OfVe247
TLSH
T16C65022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7ab73ba0e6bdc0906b2f941d210ff67b36a6fe1920832f8ed6566a7f7cec6a53
MD5 18ed462678bcb3393b51e1c439a1bf92
SHA1 b9390022bc8ee532d7e436f06a3cea31c9d2ed8c
SHA512 b04188df37d095181d5673897f801fe9a751648da89d8503c7a21063535f99b8fbc8df0f695448aa772e1951fc513d70252d5e9cdec1dd069f2bc85d24e895ea
SSDEEP 24576:S7NM9YqZqmWMUkPjZM48Mv6bEhsiyxknw4FYnshx8OfVe247:S7cBWMpPjN8DbEhMx4x8EVep
TLSH
T1BA659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 befaf988a769a2a3578551e7bb503ce0d29aff1d9f5a0055d05b8e4a49f3f024
MD5 498968c3e9f8d3d019b66d584e5b7662
SHA1 c81e8ea9ec42732c1aba14af6da83ce2d07a7e7a
SHA512 68b628a78616c490107824f0a9c732ae0bf7e3b3b045acfff90425437d88fb4141835e16f5d159338ce590a28e4c1f3c6d2fc5dbf71eb25f5c911009519de8fc
SSDEEP 24576:xW6BApg2YuyuNDYTabvcdvNYf8km1wyxknw4FYnshx8OfVe247:xF2YuHNETovAvNYf8km9x4x8EVep
TLSH
T15A858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 709d4187214c33f8001d844d816fc7d212eea45a458c60d20d42e9db3466040c
MD5 7b8d76fceb31af8ba7b6b7855cbd226f
SHA1 678e571ac2bbdc12fed402afea23434a3cdd123a
SHA512 81785ba5eaf873a4a1a362b68b54fa74e95bd3ffb8c62d139fc72e5f0959b3c2c3a08a9bf2b907e5a99bd559d1811c4215a78c90b9d86cca13491b04f1679b8b
SSDEEP 24576:xAFs06+Omlf3NXEbTojyxknw4FYnshx8OfVe247:GFs060lVXuXx4x8EVep
TLSH
T13B65AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 d0baa7ea60b88c449c039002d883ec7511464ab08a509f67a64b780dc1119581
MD5 b240a650c1292ab46fe22054b2d0c6b0
SHA1 88ad62102edd272dc1680ff360a9b2675b539721
SHA512 de2c7d8a786d1ac679ed2feb9a567f4ae751fb8c32c8bf6d9b77e3343454bc6c76a33833ec136d80629fe7c47f3878c2336a1b643a52904c1bf893cf7e312596
SSDEEP 12288:tCJnJ5D3Vkr8zxC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EJnJ5D3Wo8yxknw4FYnshx8OfVe247
TLSH
T19985D03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 15f1c9547d4389b26b59d8c5494c30a20e75d1cc94a108f08a296314947e59ca
MD5 68fd370fe665a0d4bd5c85c987d162cf
SHA1 9ca66f9174bbb8a2ed665a40458087ee5df9e37d
SHA512 22d031952e55175ff71c39f281d7ef44afb982113e02661c63f53182af3e65a0d6259e4004aaf2d2dc2a56b1449478d4e8e7d93de4a806810ff2de8b9217036b
SSDEEP 24576:xEPghm6/7IIXdwcXrif7qQncjlP65i3VuByxknw4FYnshx8OfVe247:2g06DIKdwc+eQnSt65aVpx4x8EVep
TLSH
T1BC955C15B7EA5294E8B3CAB1CA62A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 50ae235d8c780d32032ad7141351aa08e607fca3966f5230f7867bcaca400a1d
MD5 eefea302ba19f2c08215b0d5f7d8b300
SHA1 a8d65d59c51d76a7e844b55718bc1584ba9e2ff7
SHA512 8305337ceb13275614979771a9af492f92ee0afaf48c82d98139b8706aa42a104ec62d5c0929b5e762b847d45cef98ea024e7c77434f24945e2e58fbda85991c
SSDEEP 12288:eEP3RM9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9M9yxknw4FYnshx8OfVe247
TLSH
T1D365126C77DDB0E1E52A503A86A18205D372F0706B6253EF87A5D23E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 10ac51f2e05a496557e3a686eb19fe3845d671b0a33854c4f18ea7cfa6fc5a40
MD5 2594c3a57b3851793db300e26c4f97d0
SHA1 a9b7616b52833bb8d2940516a3727fa88bb32248
SHA512 d2e6da8ca6915b31e0211791dccfc4a8198e05d53c6fd63540fcd5f2ffce8d226453d9eaad7dd06ac97cdd7b16ab3b015125c42deef964fcac66cb1e0a6b9ca4
SSDEEP 12288:yjky5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yIy5yxknw4FYnshx8OfVe247
TLSH
T13A75121C63D8A0D1E57905369A7392A15A35BC709F3193DFD290F23EAE71ED0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 f32e860fed2e84a38c38c335bf323ca2fc852e20749fcf342a22cbb820c2f7c4
MD5 aae4b1c2787e4e778731889060110ed2
SHA1 870b847471f9537ab35f67816111ff858009b451
SHA512 aeff257706907597ea0b69d169b84014bd5ddd07db6717bcb19ebac773b602b2a368affb4b1b68384d4e6e3334149972cf8ae4202ace06f2174dfe70ed07fd36
SSDEEP 12288:rGX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iXyxknw4FYnshx8OfVe247
TLSH
T12165236C67EAB4D2E9191173063163626215B1B4AB7191EFC7F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 dab73cb7a6c60507e5c40e262869df74f73bbc4720354c94722bfe8fd422a748
MD5 0ae8b23ef51af0044f7bda03461936ab
SHA1 cde1286a8c71f8dfe41e4adf628f99e4178f78a7
SHA512 86505e61d324c22d23804dbe9384fc4cfe493274e771b8c745bf92d1d27ed6b0502c3d3c029923cc12bd56be7f39724cd51406ec8877c905cfc9a816a2e0a744
SSDEEP 24576:XQ9MxZKdcz9dw3qyxknw4FYnshx8OfVe247:XVKZFx4x8EVep
TLSH
T1F0558C2DABE905DAE177D23595B250C3A633B4311B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 2074758bb08c0568bf6f466aab90dfcf1168ca58f69bbb20d33974b691b8f1c7
MD5 0437eb974301ef39fcd1028a411e2bfd
SHA1 ce746f77af8ca3f3d81c733cd47c337d5179c58d
SHA512 47d05f4f233aae4f354080ee980831fd13cb68f87fad987e8af5a12e500498238d468cf2c462b00a434755c693dabc8ee0ab850eae6dad5c3f064724925c3d5a
SSDEEP 12288:myoKo2SRple9pF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:myocgApFyxknw4FYnshx8OfVe247
TLSH
T1AA75E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b6d99082cf6f47fad5f4627c906cc35afd0116819382c2002c1e77bb02e6ceb2
MD5 9200c0112dc045673fbed573c6ac149c
SHA1 8f872d8cd1c664345e3eb30a616108640ded0f94
SHA512 9a252fd83422afbe2df1d05d47caa9688c54177d3bdc13628ee90ecb6a5d871768cfd8226690af89eb89a18f904eca756e4969fa55ef625ef2981ad0b18ab9dd
SSDEEP 49152:+WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKQx4x8EVep:Y0zuNI+ix8EVy
TLSH
T1DBA57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0532ae4a085aba22c45347bcddb46e176886c5c65d82f88e1bff526e67fe88d2
MD5 3555ae14900618f74076b5466d0f68b5
SHA1 76ed6966cbe3509a757f3a523508dfc0bbdb97f5
SHA512 394aadbb42b79932ec3573686d5cf2de217791c0be1c8e5c1767cc356a977b9a4a7630aac5fa8661c44e3a999c48208c21106345da9ae546e0cbc2906a53e937
SSDEEP 24576:31QT7EcpfxR+N5AWAz3ooiYtjMqb9yxknw4FYnshx8OfVe247:KTDxR+N5YzTfjMpx4x8EVep
TLSH
T13555B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-307-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/760-401-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1280-64-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1280-58-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1280-62-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1280-57-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1280-51-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1692-302-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/1692-234-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/1744-397-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1744-315-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1744-265-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2280-291-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2280-284-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/2280-398-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/2280-285-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2296-262-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/2296-311-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/2888-433-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-423-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-445-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-425-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-442-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-415-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-446-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-447-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-414-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-448-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-449-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-450-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-451-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-443-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-413-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-426-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-411-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-410-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-409-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-427-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-428-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-429-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-430-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-434-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-431-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-422-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-444-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-421-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-432-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-424-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-420-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-435-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-436-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-437-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-438-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-439-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-440-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-441-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-419-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-416-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-417-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/2888-418-0x00000236CDF00000-0x00000236CDF10000-memory.dmp

Download

memory/3292-260-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3292-309-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3292-251-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/3292-256-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/3492-313-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3492-402-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3824-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3824-40-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3824-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3824-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3956-320-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3956-269-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3984-303-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3984-400-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4304-247-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4304-306-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4304-238-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4304-244-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4432-279-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4432-273-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4432-272-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4432-394-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4576-37-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/4576-9-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4576-8-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/4576-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4592-412-0x000000000D3C0000-0x000000000DADD000-memory.dmp

Download

memory/4592-405-0x000000000CE70000-0x000000000CE78000-memory.dmp

Download

memory/4592-392-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4592-376-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4592-360-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4592-404-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4592-321-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4888-72-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4888-74-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4888-66-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4888-226-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4936-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4936-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5128-25-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5128-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5128-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5344-403-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/5344-316-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/5620-399-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/5620-296-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/6012-14-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6012-216-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6048-299-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/6048-300-0x0000000140000000-0x00000001401C0000-memory.dmp

Download