dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Size 6.7MB
Sample260930-kla13ataka
SHA256 dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f
MD5 317c1ce217ae98b230a789544b786a3b
SHA1 2a674173b20d74dab79310cfcc83e64f05a1a545
SHA512 d15d8479a4fe8c94b3e4d10ae178905ddac5f1ab344c2d958fbede946641eaeadf72a175be6ac2334600a6df7abe1cc0ff2462bf37ba2e1e9da4d61380416312
SSDEEP 98304:3pULdlyjls7bf66D6n2kvW6HBfEqAqlDc54oNbmHsZm/VK3JTnfJ4k:3CLdlo27bfhaBfEqFx4mCJTfJ4
TLSH
T13D66C002F7529179EC9350B6697DA72D242D6D316B5108C7C2C47EA96FF4AC02E323AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware bootkit discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe

Executes dropped EXE 22 IoCs

pid	Process
2720	alg.exe
4276	DiagnosticsHub.StandardCollector.Service.exe
3572	fxssvc.exe
1508	elevation_service.exe
3308	elevation_service.exe
1648	maintenanceservice.exe
4932	msdtc.exe
2324	OSE.EXE
1104	PerceptionSimulationService.exe
4732	perfhost.exe
1548	locator.exe
4488	SensorDataService.exe
3324	snmptrap.exe
1552	spectrum.exe
4688	ssh-agent.exe
4540	TieringEngineService.exe
452	AgentService.exe
2224	vds.exe
2336	vssvc.exe
2420	wbengine.exe
2608	WmiApSrv.exe
1892	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\wbengine.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\msiexec.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\vds.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\vssvc.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\164de7875ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\spectrum.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\AgentService.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017425-392.dat	upx
behavioral1/files/0x000100000000c530-394.dat	upx
behavioral1/files/0x000100000001702d-397.dat	upx
behavioral1/files/0x0001000000016789-398.dat	upx
behavioral1/files/0x000100000001780a-396.dat	upx
behavioral1/files/0x00010000000233bc-393.dat	upx
behavioral1/files/0x000100000001703f-391.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\java.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B0AFD525-BCAA-11F1-895E-7E5B85AE0DE4} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2239216744"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01ae3f5bf50dd01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2237341498"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae55000000000200000000001066000000010000200000009e83cc35b0293214175210c9041e13eba7033e7003a454625d16e2b1be25c851000000000e8000000002000020000000783f1633472c2a2aecdd0a66231a8a924b8748d0a67093e17e0c14513ae59d95200000000f74c73f65758f288b078ad8c516d2fa7caa3c924182f00b5b92781d5a09b28140000000186d46a60ddb9b4a6f4067ab9069bcceeda60cec418b10a7090146c86e4feccab901bb004a147410bf1dceceaffbf2f572ba6a7eebb38cf78468eb8e2f34b5fb	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.cn	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\360.cn\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281335"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281335"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008c470352768de4f8d8c4585f44eae55000000000200000000001066000000010000200000004aa79441e0f3eb8fb214d242629087178420db652788a9a017ad57498b48ba83000000000e8000000002000020000000375a740f1362d5027331cd378f6e6fa2adee0849f14adebed81724e2cd40eea02000000013ed14b0fff32fa928dc199e537d50a5d1fabe5a1aaa25f9eb6b1623487e7fbb40000000f40b3c4e388a103ef3ada9be24e439aabba1ddf7f553e5006a8a0143b7fb3b36412fefa7b005d8af1b5dd42252cf7611651ef42291ab1b0d2727ed343db9e4e9	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497522647"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\UpgradeTime = bd1b33d53942dd01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "10.0.19041.1151"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\ConfiguredScopes = "5"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\360.cn	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\User Favorites Path = "file:///C:\\Users\\Admin\\Favorites\\"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1097cdf5bf50dd01	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092df737cb750dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e650e67cb750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005df9297cb750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007142767cb750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ebd507db750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000044bbc7bb750dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092e2357cb750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc2f637cb750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f785b77bb750dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051e7d87bb750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4276	DiagnosticsHub.StandardCollector.Service.exe
4276	DiagnosticsHub.StandardCollector.Service.exe
4276	DiagnosticsHub.StandardCollector.Service.exe
4276	DiagnosticsHub.StandardCollector.Service.exe
4276	DiagnosticsHub.StandardCollector.Service.exe
4276	DiagnosticsHub.StandardCollector.Service.exe
4276	DiagnosticsHub.StandardCollector.Service.exe
1508	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe
1508	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4740	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Token: SeAuditPrivilege	3572	fxssvc.exe
Token: SeRestorePrivilege	4540	TieringEngineService.exe
Token: SeManageVolumePrivilege	4540	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	452	AgentService.exe
Token: SeBackupPrivilege	2336	vssvc.exe
Token: SeRestorePrivilege	2336	vssvc.exe
Token: SeAuditPrivilege	2336	vssvc.exe
Token: SeBackupPrivilege	2420	wbengine.exe
Token: SeRestorePrivilege	2420	wbengine.exe
Token: SeSecurityPrivilege	2420	wbengine.exe
Token: 33	1892	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeDebugPrivilege	4276	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1508	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5044	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5044	IEXPLORE.EXE
5044	IEXPLORE.EXE
4696	IEXPLORE.EXE
4696	IEXPLORE.EXE
4696	IEXPLORE.EXE
4696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 1040	4740	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe	123
PID 1040 wrote to memory of 5044	1040	iexplore.exe	124
PID 5044 wrote to memory of 4696	5044	IEXPLORE.EXE	125
PID 1892 wrote to memory of 4488	1892	SearchIndexer.exe	126
PID 1892 wrote to memory of 3092	1892	SearchIndexer.exe	127
PID 1892 wrote to memory of 5932	1892	SearchIndexer.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
"C:\Users\Admin\AppData\Local\Temp\dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://bbs.360.cn/thread-15667307-1-1.html
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://bbs.360.cn/thread-15667307-1-1.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5044 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4696

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1224

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3308

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4932

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4732

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4488

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3324

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1552

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3084

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1846164713-4096795028-774071693-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1846164713-4096795028-774071693-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4488
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3092
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9583776738c8341bffcf4161f5e9aa243b63c3f9ec7d287ef5ce5a8a7ddcaeda
MD5 6c70b14c45b8238447b43fd9c88d5751
SHA1 bd64087b54b4439016f78c8791923a6075e37a2e
SHA512 1d01f01e42ad37e1b66dac4e4caf39e082d37ca19fc2fbb9d84361adbef4cac27064a7d24fd0c51408da22e3c05a3b7a4ebf1331afe593271f704bd1713a5b1d
SSDEEP 49152:Xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnnfJ4klKXnf:F3q6mjB4fJ4k
TLSH
T1E8D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 d1cdb7e31ac18bc4866edaee6030c8bede5825eef7602c7921f1c73b3605cc8c
MD5 22eed2d34011640772fe3209b15e90e3
SHA1 a3a0fb1ac19ae7ee2a67c8fce9f570c44694e394
SHA512 a6a96c4fd1e34b508e6f61b61206c99155669005f0c1d2be2f92c2d13ae194c444a17293be6a4f7de4366b8e6db6dc09f5ff73e0c74a82cffb9974201491f6c8
SSDEEP 24576:dXY9DkczAsfJ4yL/tNCJPXUQrPnxaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ekcxfJ4klKXnPxarSj8RoTCCW
TLSH
T11A75122AA3C049F8ED67827C89A1D405EA337C894765E38F07E099692F773D81E3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 6ef12ecdc537804e51c7e28d3573bcceab916f631230307c498bf8d11d29acf5
MD5 9615122837818207575dc73fbfed32fb
SHA1 5e971a39adc722e7b110a574dace635c51ea95c0
SHA512 3abfb4c03a860ae7170174e1813f46423d911cce0215cf7f6c3dcc80ba908d186a6fa61a8e6c85a4a12eee5cc3a8da7d7be399f8e1ee600b9a422da60e4ff89d
SSDEEP 12288:K1XLsswWkxy2lRq2czAsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:AXYfDtczAsfJ4yL/tNCJPXUQrPn
TLSH
T10905F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a3c8ff61b6144d3720ef52590932bd81e80eaccf3d214ed7cf3a8ab8d4912698
MD5 124bd55ca8c4d69b1ea2dd26c360bd27
SHA1 79442460e197e2b2ca64201549883b861fc979b5
SHA512 813f0a8c0c7ef2ae610560a9b135b177ddcffacd98c7c864535357322ef217b02452afd8eb19e448fd313500d735831a758c085a3baaac4326339fb8e0bee7a3
SSDEEP 24576:nAhGL6IFoiwtA5l7S531fJ4yL/tNCJPXUQrPD:nAM5Foiq5FfJ4klKXnb
TLSH
T1F9359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c30504b10d4b67597a8722613b15bd4a4852c4a4eb238ef8d54524e97fcc5420
MD5 48da9f23c941c69663b9f5bfd3b460fc
SHA1 d78b686b79668095425999c3fd0b10e34942dc88
SHA512 39855e4017bf92aa92c5b80502d01fa5a72563b21ce3e6677fbbcd073c8a1c963441f236387375aa0b512ae25ac21a1f20b24c9dce1b2771a7d58285a1ee22fd
SSDEEP 12288:0mw5HEjsChNEBFgl0WDm+CBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTt:xwuROWufJ4yL/tNCJPXUQrPx
TLSH
T1EA05014A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c298fe629229adfc2cc8f3616af5dcd732cd26ad5e64f847f577f5d454d424fc
MD5 683956dca7106f1066e5df4d38ec4958
SHA1 4b8f2ed3f80c3bdca4316ff1b09bccc675f0caef
SHA512 d61e05b429d306daf991460a075a65615f297f76322f551eb19a6150c1c953e1ac02968f8ddf057661177d5f575007daa74753f9f4165136c8fc47321f6ae4c0
SSDEEP 12288:hyZ1IyKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:oZuXfJ4yL/tNCJPXUQrP7
TLSH
T1B8E4129B32D460F9DAA782BC8AD4D101D3317CD2273A43CF5A5195963FBAAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 56d439e55ce4528a10ecd2b62d3eff7ef160f041e31fea840f9f242bdade140b
MD5 ba7ad9aa65120166f64eb79ef237dcd7
SHA1 63f297387cad0d76587d00eded8ca6566450fcd5
SHA512 26a684e1fd9bca8d3b990763def9b8bb97284b82e693d5af9009f8842c69bb8e7fc4ae327a0f3dc37c791bb7c738fed67b13fef78705dee155314db1619839e8
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uy:7QRQyi36YOcPDLvw2gAf+PN3UfJ4k
TLSH
T184667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 77c013ae12de387e6eaac4cc0bff4069efdfc3c5422f60595a49861ce7d0570b
MD5 7eb7df3bd3a915154eef9984746253e9
SHA1 a313eadf40ea68f75304661d46aed1f9d745cd91
SHA512 1fcbad503c07a3e4804db28ba5dc47d0d91466c6cca9a9b8f22e605510d24072345af524e7309edc6967a45e4fd09e7fb4562d59b8c5db003cbc2d83c52860ca
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ua:QQRQyi36YOcPDLvw2gAf+PN3UfJ4k
TLSH
T128667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d562f8d6fb31247a720d2e4d3ae94b8107644d47be15371cf77c3cdd405db36f
MD5 92491739a00443a85901eb2b671724ef
SHA1 fc37858e19a61d968dd1f5ced8cdf64704637c07
SHA512 25418adcc20ce9b0d074bf0c1ebc9be7f7b657dffa32e49daacb3bb6beb706395dc52334b472c5c839c4a39be1255f8328b5cb1e5a2333dd2682b86a367a98cc
SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0nfJ4yL/tNCJPXUr:h68Qg55nhkeWu7PNU3/qfJ4klKXnY
TLSH
T1C8B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 843dc776537e1928c2d072fff81c9e8430e659b734bd603081c676ed8e38837c
MD5 cb0acff6a16e82d1d247f530533c4476
SHA1 3a14dea82b30190d9eb0dbdfa66a5e0b9adbbf8b
SHA512 88e9fbe23271a5ff3718c060bcf6fc8dc22d53af7465ff0789f5fc1a45043cf3ee608557a72d5eb8f9672bc41ad169ca0c073fb6865969e84de559353079b8a5
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99y:Iy5112gYy5azzVvU69nLKnhZLfJ4k
TLSH
T1E1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bdfbffea224065575d058ba3a7c6ffa2e14127d160869e8948eb985e31232d9e
MD5 c5b75bea322104ade5373532d808b6b7
SHA1 b4000d96eb4116712a312775b6a4027e6b0c2c11
SHA512 52a10a789105664f0e10a8a9a740cc048c030797769127fd1c70aa234b988da4f160427f5600aab6da83cbcbe891bf2a15b9076591be606244bf4f86e792ac1f
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl8fJ4klKXnF:Hu6JmIxd2d8fJ4k
TLSH
T1EFD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 67ee709fcb78141d079feea5517dd60f35d852ba6cbd3e872f1e8310d753b2b1
MD5 cc5e82b7b4fd3b2420afe6022bb70664
SHA1 6fa3211785bf42df5091ef105f91d17fa5e45b08
SHA512 d51a79ec18e91de34f6b56fd21d2e8b27851defbf783bac760585973b75ff502d02c5ea0b32c5542c0c47409d8dfa2ba02b296a73f6be6f6767d97cbf723adc5
SSDEEP 49152:B1hpsNoJpF1A67U44CwH7R4xQfJ4klKXnw:BmifPqRVfJ4k
TLSH
T10AB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2bfc70dd35c5d21268467d7f1841c73035c5a8abfc03b4dc24b6ccb4385cd4d0
MD5 4236d761d3244e172d35fa14a6ff7d4c
SHA1 ea7bfbbf8cea2a5377d53f7e59fcefc7f4d8a926
SHA512 0cae09255d5351ede7149525962a8c8dc8fb68c37135630e35d800204bc2dc1438eaf1c830a042180ff4f5a07cbfa2fb15a2957c72d48cf63728a0e95b20e3d6
SSDEEP 49152:LSuZQIY0Be2KkRVtOnks6NMHqXfJ4klKXnY:Z5dKqi61XfJ4k
TLSH
T1E7C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 533cd554a5eed3b2a77bfcc31c865e09139cffc6eac5ccd1a150a04d5b40921f
MD5 7da7abb45703560ed649bbb4698ac66c
SHA1 f68ae53790a47cbf1c5a1cf000f165c2a6f9cdbe
SHA512 d2b807a8cb11630a994a9f60bf32e47291d7fcd9a753a462eda16bdfa57cdba0f32a64b16a055740f2374de49e38c61706fd6946933aa6b9fd0cab97c2177629
SSDEEP 49152:ChtSn8EApI0figjgiDn0AP5wsfJ4klKXnQ:jX2iWphpfJ4k
TLSH
T15795BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 695dd94422dae41605700b7179910432206dfe6f8a4e40b0af36a2b805ce4a54
MD5 2c8b49e71ecfdb639b48febe0fe2e656
SHA1 637b9d1a89d263955db10a4b94b2c3b0fb180a52
SHA512 2e3b30248323d41cc2fc43b7e6b3c0777c789577f00e9604d34c517e39e6259ca0bf900be38202348cf10f734ff2cf438ebb8504d4f0a0bceff2abaa9789b006
SSDEEP 12288:JTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:JTfJ4yL/tNCJPXUQrP7
TLSH
T1C6C423AB60D5948ADE5587F81688F001C3087EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a4002ea0e7cdb6afae453ed1d8c20ee98c5793b5a4b90048ef860c09a47f1cbf
MD5 79c2f6ad2274d3ae4848f9d73b79b418
SHA1 2437750b1388c8152c07f242a20a8f4a81e5ff16
SHA512 ae63a31ded76e1d90d2f4d9365cdf7c2dc9e3296b070312a9d450b60c958294670826570135659c37e41ea5b49efcd194da3497aae12ad5aa6561e1a120ce957
SSDEEP 12288:FGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:FGfJ4yL/tNCJPXUQrP7
TLSH
T12AC423AB60D59486DE1587F81788E001C7047EC6672F62F7EF82B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 07149ae9ed25ef7a46cea0a1b8a6422c3889fabb4bcc0612bdb19e06b0f79b83
MD5 72912c9849d1c706f9b6eefdbba44dd0
SHA1 ec268aa9a56d7d9f1b9f6cb1be6d66b1e3696b37
SHA512 f396aef0f66d479179fa49760bc1e27e6bc744a0472cd630831bc6acfcca3c2f919ba8aba6078154ca2e2b71b6b2158bde375c64278bb7dba89c96588847dd3b
SSDEEP 12288:b4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:b4fJ4yL/tNCJPXUQrPK
TLSH
T108C423AB60D5948ADE5587F81788E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3740f51a132565045b07e3bef6ad18df57453a9ccfa1b8504a8d92a476c205aa
MD5 84fe95cdf0e5861a389d426df6981fc1
SHA1 a875f8eef0b0457d61191b373238d6a4a20c515a
SHA512 afb540cde0666da1e47a9a5997785404e160012f7d7494a8ee01d9f4bfdf09de1848bc8c821bc7e158c620c03a3768527011c321ea119b51785c859b2ebd8981
SSDEEP 12288:8VVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:sfJ4yL/tNCJPXUQrPF
TLSH
T1B3D42397219480C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ab6532b45261a6c095d32eafe51b87545afd573e0b3824feb3d5ec2385e6c966
MD5 d2b4976f49274e5495b56d1b1631f96e
SHA1 2b24f34cf0025adaccff25b439a6ee98891bca32
SHA512 6fc439fbbcc66f65b0ec9676d5b592ecf73ecdc657ca849577d5e702bfa81bb31c09e94dc5f1956fdf5d740309942ea25177fb9964657e91ac059b15c7f8e15d
SSDEEP 12288:OtfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:OtfJ4yL/tNCJPXUQrPo
TLSH
T132C423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ef3d73deb9e5b72a30524009c0047cbbd25198c71d6d81b00c73ed53aaa6a234
MD5 bdb22f34cc5d933db96e5e0352bf1f8e
SHA1 7aa79241d32ac1ea751046928b752e03e4c8c745
SHA512 69898471e4232b0a6d511fadd68e6e7db840480d165d3de680cd2daa53cc769b2412be8cc498d9e995c205005695f6edaf438bb55fa769e9e5e8c434f753e721
SSDEEP 12288:wCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:wCfJ4yL/tNCJPXUQrPI
TLSH
T1C7C423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0e607a614b69d3bc2ddaaa904ac5825f9b3cc144200002dfa50e6cae2c7ba1b5
MD5 1b5f8e924b4bf0e9a2c80e0ac7f11ba8
SHA1 87f4842267df5afe8109ceade62148d33d12451f
SHA512 751755d604550368d412ad4ecd0820ba56cf28925a86ccaf1baf8d5add3152cb17e1a6ade767c5929c84f1c2ff68420e5359d7b32c82d373b0250f914ecf748c
SSDEEP 12288:T+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:T+fJ4yL/tNCJPXUQrPg
TLSH
T1A4C423AB60D5948ADE5587F81748F000C7047EC6662F62F7EF42B8827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 53bd8cd8fcb4f36e8e24d8f42ff92783a5db94219fdb94bd722539763e0f4c91
MD5 2a83eab4cc3c0b68aa5ed34e71ffd71b
SHA1 1d7373aeab6c45a7b86c0309252f645921affcaa
SHA512 3ef74d2c6f9ed93b9d8f912e301faf7881bc20a56c3a749b4e9588285bec7cdf6ffcd4d8e3de3caed05cea79e94ad70fa499b0bc83387934fa4e00c8bbc87837
SSDEEP 12288:9iZwbDzzFEoS2cPvymfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:AZM3zFVSOmfJ4yL/tNCJPXUQrPc
TLSH
T1B90501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 748857c07deba9083ce0a1acac15342dd3ef3abbb3eca595ab2921caf9c962ef
MD5 b2364c9b1faee673162ac078049e77bf
SHA1 76d05d8674dba03b479942c69b6f9588acf0fdc8
SHA512 1555b28817b7f2b019a061ebf9f5c5148f94f1abf9e839c9d593d7b9f17a1ff13a9f54fb5f032708fab9d4e92d1312058724841a01c1ac165aee2ce8f5816126
SSDEEP 12288:/HfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:/HfJ4yL/tNCJPXUQrPq
TLSH
T103C423AB60D5948ADE5587F81748E000C7087EC6672F62F7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 53e9546ab1a71f054d20de96cc304d65301b267be8a9faea2f7875af09107f99
MD5 7b46796da0ebca6c246679fdfaac1b73
SHA1 4867fdb07066fc270de7ed9b859445b64e9a3f4b
SHA512 abaf1a1cea0a7187e4607e8e886a26b95990aa4600ce13c0601c626bcc36248ea3976297a84359af7a272b22ba47e4151d9f4feb6f8ba23cacd3f45d6e4ff9af
SSDEEP 12288:A7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:A7fJ4yL/tNCJPXUQrPc
TLSH
T13CC423AB60D59486DE1587F81788E001C7087EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 223a4f9a7b60115cd4daae5be244f6521e17a7ddc1d802972d3600df7b85ad71
MD5 087d2c261d79ba864bc9947b101051d9
SHA1 51aa3ebc38556222fb006eacbcf9267d8669b5dc
SHA512 24cb1b8c097eddb1566c49de9f0031454de319d8a8cd4c623058050a0da64b92c7a4eed70d6e57c30c5436e99bb9022d17bb744d8c3d594450810a903d534164
SSDEEP 12288:/yPz5L8KfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:yzyKfJ4yL/tNCJPXUQrPU
TLSH
T11FF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a72471bf6373b257438aa2a0e3b2536f53144e49b8eebd7387daf5e25022fd36
MD5 86884b947125fbdc82883f7b063e31d7
SHA1 d59e2965bf251996ba77e4bdb042fc58bc9b35b5
SHA512 f606e60a7989935c125691998238e58d49d7e8ae74bffe09d09bb944534efe37f0d04b90aa3350cfbde5aaec9274e9bee2136a79d74961f902adc4cb907603a0
SSDEEP 12288:hHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:hHfJ4yL/tNCJPXUQrPF
TLSH
T1E5C423EB60D5948ADE5587F81748E000C7087EC6672F62F7EE82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9981c81c6f52331fc7865d90cab459509e9fb95aff4cb445cf84f9b3965b88ad
MD5 328a5b66b28c4953bb60c402023eca40
SHA1 f6bbf1e859c2642c20476c39598f01de08b0d1ef
SHA512 88a80b46827bf2b589e78acbffc7d223e456d9f28cd41e8c8a4d7224dd3401feea8e53e72bf32ecdadd08fa49b7dde8d47b62cd65b958a0a7f64cb2d15e3f23f
SSDEEP 12288:lHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:lHfJ4yL/tNCJPXUQrPF
TLSH
T1FDC423AB60D5948ADE5587F81748E000C7087EC6672F62F7EE82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6994d3b47d06f4846b7c58bc7cd9f8fdd5ae37c757c675b4351df43796972177
MD5 f9597a2ec33d3f6fbcad036eccff96af
SHA1 a174871e8d0bbabbe07faa61b815c57cff4ea953
SHA512 9a0dcf19fe32f1d666b1cddf9962e0049a23cb9bdebe2097bcc80a1555f8051b5190eed884d0d8a124264ac4f329bba548b697ed05620e5e3fd25944333d18bb
SSDEEP 12288:wyPz5L8KfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:BzyKfJ4yL/tNCJPXUQrPd
TLSH
T1A9F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 1f95449140def348c31d0445bdadd02ff0f46444c67e7934432f1e6ce7707ccd
MD5 3f167c585819371e6dea0257ec1d4353
SHA1 8e69a0710b2b3b373a29a32eb6b885955424b348
SHA512 d1db621125599ac0344b2da699f5aa55c6bca6c291fade3793be62432e7e1cc36b9607b135d1e18af7cdd672ab78b94bbd9f788e83e96eabcff80e596d8226e9
SSDEEP 12288:RCd91WYoaLHF3z0z04PDvhIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTU:sT8aLl3z0zDIfJ4yL/tNCJPXUQrPY
TLSH
T14E0501A5B39018F8EC67827EC9549502D3B27C9A0770C26F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 016bed4e06b412cb0e4240d0944ec1da6e620bd3764aa8c15f67c59b006091ae
MD5 c761fb4b15009100bd1de3981abdc945
SHA1 9de0ce99d63eff960cedf68cbefdad2852ae58e0
SHA512 4b25deaf2d587a4e201a3a10ca9bfbaf007baa46cd3633ca3ec0d4323aaa8833e56e2c7991b521a4afae7ab46536e8cdab882178fa63499d74b098b1f9954c4f
SSDEEP 12288:9i4e7+RdTfgwCHKy7GLbbdIvZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGB:93rd9CHKy7GZ0fJ4yL/tNCJPXUQrPq
TLSH
T11A25CF91F3E410E8F1B7CA758D659502DA767C9A1B31DA8F03A4255A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 20658ba8b22f60e8651500b515961daa04475928513bfc051ae6dd964a765763
MD5 3cadda39cd2725197527a59883f75bb8
SHA1 fd1016bba5ed0d567277a28087b764de451de302
SHA512 65ccbd6bd4bf750c98b952dbf1ba384a6469d98aa1047c7aec8ccc13ce0c91448c8ff9a2061df7b6ed94cdb732782418a57e2a26862ef532494bdf35e65abc88
SSDEEP 12288:OYfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:OYfJ4yL/tNCJPXUQrPL
TLSH
T17AC423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4f6fb117131a973bec622bbcdd823391d8dd431a9ceeced2a1012c654f4e3d15
MD5 2bf92e1a9a016d2b9dcaf82494ed5984
SHA1 32d3c5125e9e69a68793c0942e4bac36927b1eed
SHA512 87f7f96373ddd494820b39b0018207d026d9008611783dffab081a18cdbdf602427830c0a9c8ec572f1a50cf37955d74a2956348ff04c4f3814b642747cfd550
SSDEEP 12288:JqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:JqfJ4yL/tNCJPXUQrPt
TLSH
T1CCC423EB60D5949ADE1587F81788E001C7047EC6662F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 e212f61daa7205f21a78f16d583df1c54ea6f11f38382a999750082ef0fa3b74
MD5 5724ce0131f8700c8dcc5ae9ad27e658
SHA1 f2bad0583014496aff8467e1cd61135cadc2aaac
SHA512 3a8da661665c1f79e871fe66a729349119ceb6a47754c5efaefe5dacb0b286df862d0b3fbf18ac5020950a35af1a3bc5e0d198866480c0dcdf3b4b56039c50a7
SSDEEP 12288:pZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:pZfJ4yL/tNCJPXUQrPt
TLSH
T16BC423EB6095948ADE5587F81748E000C7047EC6662F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 0f27fcc7ab145d17b4425f88d654e7eb19527e5bdd7a4a204707804b8d459cd7
MD5 b2b01e28fb410a5028d0d9560ec77cf3
SHA1 b176483b6dc7218456b351ac8d0a3ae00f563194
SHA512 07eef56e956198d9d0f46c18fc6086c9e1a785889e2358a10176cce4e1fcbd7e7d72ce83ff054e41bf9429fdb01e9f6fcc768861601f50977ed2db303841f8aa
SSDEEP 12288:UHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:UHfJ4yL/tNCJPXUQrPd
TLSH
T18AC423AB60D5948ADE1587F81748E001C7087EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 465dc27dbf18fdeaad8943eb75bb429a34a1738d1763075644749c6bdd893467
MD5 9904508866d2495879a063a1c217a14a
SHA1 1c24b94fb037da4d159a927e2710b2e90ef5f1ef
SHA512 900edcde2e58c2944c592559e22d54a7a43e38a037eac13fc16993e287e5a70bf0eca922491989c4f4f7596b1ad016bcb4846ff53b6e02244a4e2df545f4c685
SSDEEP 12288:PYfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:PYfJ4yL/tNCJPXUQrPd
TLSH
T1B0C423AB6095948ADE1587F81748E001C7047EC6672F62F7EF83B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 a7ffdd7264e2086c6e453b92639c4a7165f9e3922a285b793281aa454c80539a
MD5 e58de5b94d96758a87d12c959deeb953
SHA1 60abc6e1a64365459f5826ea1e8063c09b38deb1
SHA512 68dc63f184523f6fc7dcf8dd496ba2df5846289b6688a0b5cacbc10d905baaa98f66e4e54e642ad3e6d38ea84d32b730607070b201c450fa663ab6018b25f457
SSDEEP 12288:XffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:XffJ4yL/tNCJPXUQrPx
TLSH
T126C423AB60D5948ADE1587F81788E001C7087EC6662F62F7EF43B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 53348322fd9d04b82dc43d230306a2601ccc4033a63528f97582a6ea203bb9ed
MD5 fc4d8e04e590bfec0a72d7d453c2f666
SHA1 8ad5400bbf86e57ac45baa95fa36c39689f8b951
SHA512 1aeddfe162f1e608e6a27ea163fec7104d212fa3eb36c7686c3d832259aab60f78ec4b8afe88caaf800d33a781fd726b87e12a7b842e90308869f67e7e27ca36
SSDEEP 12288:JtfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:JtfJ4yL/tNCJPXUQrPw
TLSH
T1E4C423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 f029d7638489754a2f51177eb5ac4349f1705ecdaa7696cb4f5fd9b8186e2d2c
MD5 9663383eb30e3b5300e0c1b8eee84733
SHA1 a968bfe1117b56d15c1a971c2e8e4f13ea023a5f
SHA512 06dcda10c3bd122b457cc09b2254d3924241cbc44c63dd5ae5e3d5c28caa782bce146b90648fd6b6ae74db5ef03d7317c685d518c302d8101446ef4eebbd55c8
SSDEEP 49152:pP4m4IpOO6708KRfJ4klKXncIarSj8RoTCCW:fppOO1LfJ4kAJTy
TLSH
T199B5D02DABDC0095D0BA927886658A49FAB1742E1F3286CF1160937C3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 21e75af8ba4294f6990f8d6b5eddb97f7bea7250bd1e863e1b23f56d5b8d3922
MD5 a135267e46a1641a1f7c23fb83fd9419
SHA1 465ea1c142b348395e8314d3dca4e84173205c85
SHA512 d9ba9b5e1cf67b648b61684c2b1102bdee411137e0376ea29f17e98078f00f447e2a46a7246fa77548630688feb9bbd73fb29f0474125d59a7f4755d3e70d844
SSDEEP 12288:ppsfXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:KXfJ4yL/tNCJPXUQrPF
TLSH
T1E7E4015AD29441D8C46E92B8CB449201F3237CA593E2D3CB97C0F87E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon[2].ico

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7R3PVEMI\favicon[2].ico
Size 9KB
SHA256 6862f58af62a53c1fb94c57bfd81985ee0c662854af711b6365121e5f4f9aefa
MD5 d7a2c3ffa9917ab7e5d7ef759f226d97
SHA1 e52531261a610c7874202db8ef270e9b0964d729
SHA512 f84d765eaeee5bd89f57b5f2034a4320b7effc5dd4c887aa60a2ff6cde3fbd89ad22724a63f15d322177aad659757da1965dd2709eb460de50f363cf95567f46
SSDEEP 96:9OHz7PvebtHeyRrkxmln2s0Ax5rXxBYDm:wXEJeGrkx+n2tSXLUm
TLSH
T1FA12DBEA68917CD0C50D8AF197BDBF78400568171AF0F4DEE2755A1AE326EA0C94343F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 92b7a9c6544b54384bb16a4fbb57cec04a22fff1677c43f33c2ecd28d4bac464
MD5 d6c76a18a339a7624b90f17ec7cd3751
SHA1 7ad800307199cc4b77c1ca1dd0b7962bc22bc8ba
SHA512 154456438b1cd03a1b6f8c5694dc6022be75fff8be8e9c18f7247b5391831b313658ef7238b7e16548de38c42b6143131fe33426e209c7907350736bed62a85e
SSDEEP 12288:c3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:c3fJ4yL/tNCJPXUQrP2
TLSH
T1E6D423A761D8944AEE7687F81648E000D3097FD56B2BA2E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a5b1cbdaa92e0af971adf32a333258f4f9cbeb5f00a101dc62b523a5d3aa6bff
MD5 e54f9f32990baa306963fe9173a784c0
SHA1 f171f5b1c409d701391e4d6b2b3a64a00f59d16c
SHA512 fc4a03ee222b3f76c79535daf2eac01a279b4ef273dd5547ed462c6ae1cd20bbe707cfabffc28f05c579a71772ff4f70611cc13b8aecf12672237804afd06f47
SSDEEP 49152:ea0h2GEkuAe73q3pp46zwwQtfJ4klKXnm:ea0hNYG4JwSfJ4k
TLSH
T18F859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 ba0f73db06490299b274bc9addc407ea38fbf48e917fc9f2658f2cf17ad31c09
MD5 a96d9a432bbac4535f8883420051b377
SHA1 330f5b2f0561f6f2531f372efc77697d5bfe8993
SHA512 2424020debb58b7526db098277d3768bf27b6d050b272782ec8ec8da34326bde4698926f43205bcff7c4baa21aca59d51e5f25058f207737697080457ee65ea1
SSDEEP 12288:JhbHjfXWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:JhbHjPWfJ4yL/tNCJPXUQrPf
TLSH
T1FAE402BE22AC20D9E571D2BC4684D106C331BC951726A3EF67C2917A2F7BED51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 65a64dd068cb7e515f19f18257ed760ab4d41f02ce5ff102bee7e88065422db8
MD5 658665412b7436be44e6af054edc0a5f
SHA1 a5e4028659de9d28b16397cde44f6c8cca9cb7b0
SHA512 08e33ff56e767f00e614e2fa666976835865061973b8daac2bc03b076a44225ecd2ee4269fc8649661a719aebdf8aaabdc27c4a7dd5bb088584a75f3952def26
SSDEEP 24576:O3YgnJcRTk4yti+R5dBR/ufJ4yL/tNCJPXUQrP+:OIgnaTk46pBR/ufJ4klKXn2
TLSH
T16845B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 ff4380e23ea9be794ff1e957e4f08a6f9ad3dabbee5faab3d1381032c08145a8
MD5 ad3875b9f018eeee407d1530b3635353
SHA1 7bf8456a46080e0238fcee390a4126fd88ad461e
SHA512 0b1cd9627c1ec5538a2081c761110b3663fa4bbe1dc23696f685bb3a2e5c75ef70bd39c109c58c42ac5ddcbfe4165763093877647ac7d7e2ac098eb9bb210a4f
SSDEEP 12288:erfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:erfJ4yL/tNCJPXUQrPR
TLSH
T102C423EB6084948ADE6587F81648E001D3047FC5272F62F7AD82B8857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 dc1bf72ee49f1ac863dde8e2d8fdcb798a401e06e01bdb4ea1c2b073dae46193
MD5 3c7ebab3626e6ac6a5e07274be3b0a9c
SHA1 7b721dab6aa52310e2c4afa5c1a33ba5c833380f
SHA512 311198236708abbc2057ecf5704318e70c0347956235c74a3ffe07504439e478dbdcc4b6fc0fe050ea4ffef299d614751d62b5ff194d3d4c6ed1a6f1051917a6
SSDEEP 12288:BObIA4LWOsvAYFTsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:2AL3UTsfJ4yL/tNCJPXUQrP5
TLSH
T18525F155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 f6fddc0207104121dcad356d0a3a3c2072e09f5737ce3cca2910502b5f6947ad
MD5 365dfe367b05d568cbeb17222d8e08cc
SHA1 ae97d715d1375b6f397dd408c22f0279148cc89e
SHA512 0bc153e85ff4fbccb86cff086f5d38542f58e000a5f15e313b4320ef6a94933116023464ba925c9ca08e8266b81a4ba9ae4694611a54825c3b7629f688254843
SSDEEP 12288:hpFtvOQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:3OQfJ4yL/tNCJPXUQrPx
TLSH
T1F3E4026A32DC10E5D576927C4A85D209D331BCA6172653EF46C080AE2FF7EE86C3D762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b4f74b4d8d7a4f9b751cf36ee9d6aedb9c8c2f64c04e73563585861f7fa0d974
MD5 17e8f829f59638e74dbbeaa3aeba80c0
SHA1 b0377e86905d0fde5797c17b10a8e6bec2d65752
SHA512 e63d7ac230860de9eca25ef5c9b581dd49b31319b2d13b19e7990c721a36c49dfa452a0495513e8eb71a89031eb53696bb96948b6f0b9b4a4d41c87e703006df
SSDEEP 24576:s7NM9YqZqmWMUkPjZM48Mv6bEhsHfJ4yL/tNCJPXUQrP/:s7cBWMpPjN8DbEh2fJ4klKXnH
TLSH
T1DF65AE2E6BEC81E5D577D13DC9A28205F2B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0c3f30def3c621b3811a2543f28bf3aefde083215a5946f23d097422aab8dde2
MD5 4ad383f043a98d83fc617bf8bbb99db4
SHA1 43e957f8fd39b1d9a42aaec1c99f855f9f9e11d3
SHA512 572a176eeaebb398e8597772ed4769d010ffc83514e941dad02194dd0b5ed5c1e252c686f35e9b3ecc04215e3f1935a0b26f3a48c7821fed0ed834dc6dc241c4
SSDEEP 24576:6W6BApg2YuyuNDYTabvcdvNYf8km15fJ4yL/tNCJPXUQrPi:6F2YuHNETovAvNYf8kmnfJ4klKXn6
TLSH
T105858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7a6f0dd8c29fccb481e6ce3020e1411243305f7e167070503edb94502bdf8091
MD5 d87ebacad3865171f83f0f58a28fb621
SHA1 fc0f551008a06b49285a24b5d93e657bae1d83db
SHA512 1651536ac7bd7e2ed9278e9586f790552f980fd3f0e172ee02f66ea6fb2ea5c284469ac236baf3ebe97f238f770f56e403dbf6c44b62f4c4b338644c46bf9eb9
SSDEEP 24576:3AFs06+Omlf8NXEbTo0fJ4yL/tNCJPXUQrPE:QFs060loXuNfJ4klKXnc
TLSH
T1D765AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b58e09a90b4b0b240b0db26332ccf393855345342999e61dc3e85e1ab167032c
MD5 d3b4b810e555b19bd507fec8fefd2fc7
SHA1 17c8ecc451cf19a649141201128ae40531af23b0
SHA512 a67a4f420dd2bc15b312a7f9ed7acab012ca7e432dd556148cb5c098383f4c260d66210c0f76070e7e0d5d9ddbc93fcce25227b218899ff29fc662afbe25e1e5
SSDEEP 12288:RCJnJ5D3VkrDzxnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:oJnJ5D3WXNfJ4yL/tNCJPXUQrPd
TLSH
T1BA15D02DD2A810E8D4B7C3B482496746FF72386D2F266AC768B4D4353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 10a9007f0d49734eda44cf337a03516746b5ee2613e10855c8bc7ef92c7dc899
MD5 d10970b44101edc9071e05727d46af82
SHA1 52d26216fa1915969ea605dab84c613ed8ccfeed
SHA512 52e352ce3dbddfb5f6074a0e20ba9fde3535f6d128f1354176ecb78490b96aa29b63bb3c6cab86957671d39c0fbb470c581d7e034feaf7fdddc160e3b6c75034
SSDEEP 24576:9EPghm6/7IIXdwcXrif7qQncjlP65i3VuufJ4yL/tNCJPXUQrPL:Kg06DIKdwc+eQnSt65aVTfJ4klKXnz
TLSH
T14B955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 f09fa9b3f833a1a87729fef81d9067514b9f1a069b699baf0b76ac66f0ae58c7
MD5 cd58ff7b49a3a03a1c7f95c03ab88147
SHA1 59cb1c9d2602f4e82559e16ca53396411d4dec86
SHA512 92c50926ecbd6dae2ac3159e33fd1ef40c7ed80662a8fddac882727b3e535fff6a1f808f193a8b29dd268c0b74c3c2b665e3434abb6c0566ba4cd487d71419ca
SSDEEP 12288:8EP3RnBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:3nBfJ4yL/tNCJPXUQrPE
TLSH
T1AEE412AE269CA0D9D52691BC4680C101C331F4A12B2723FF5AD1D17E5FBBAEA1D3CB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 16286f67b47510ad8d5c05df6073cd9294146ee0754b41083f0291e3f4e74214
MD5 8be6981fe3ff0f87edc0735da90f19a2
SHA1 20f83150ff2a0dcd7177dad4588c47d6fb8705c6
SHA512 974c31be079d034978687ff18793e1958e3251bbc2c75e47b91a563521f93721376424a182d0e711fbfcc4efc597bc018eb25d3edfcc222a71ac47cbdc670ee0
SSDEEP 12288:njkyGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:nIyGfJ4yL/tNCJPXUQrP1
TLSH
T137F4224A23C4A085DAB647BC5A55D140CB34BCA06F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 0fd6e4ce2dda1a5e63fb1bacd5cca09ac5bfd1984f18fca54d214f600b6c24fe
MD5 74d24bc5eca22612e0acd87b34d01b68
SHA1 07bb5d7366666e956dfb789d46326e9d5bea4835
SHA512 a90601e67ffa8665a89aea59b0f6906b70a90fb96fb273540e018dd41f1f85b3b7824caacc4f9dfafaf88924ab3d9ac79c39fb0d1032f28a3b929a9f46cc01ca
SSDEEP 12288:cyAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:JAfJ4yL/tNCJPXUQrPP
TLSH
T1FCD423AF2095A48ADE2587F81648E000C3147ED5272B62FBADC2F4A17FFD996157C781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0e93f6acd8cbd864b6aa813cbf5c8e577e744bd106ed046e850f55c13ac8fd5d
MD5 4b55bc98e59c5e7a7c1e99de6da0b0f7
SHA1 e19f41b93b31d9117056872d58a7cc0456621739
SHA512 48df2302a667e0f88e4351bea80b8d9d6d235f9eac7e3e3d2e1228dd80e6d742bb4432fd7558186d1d9bbcdd74261f9f5a087e99648ceb714000df5a275a35dc
SSDEEP 24576:hQ9MxZKdcz9dw3vfJ4yL/tNCJPXUQrPR:hVKZvfJ4klKXnJ
TLSH
T152558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 29a90c731a2ad6fea5646816be8490f123007784c6638410b3952505d95cdd27
MD5 90d1d0d0af7b910829841ed218fdd585
SHA1 05d74f205ecd4eddd035bd703aae16f61b1c939e
SHA512 96d0fbab5c34fc73251cdbea93cab05dc53f822b8722f8e3ad178d205e552efd5406c6ed7f70db2ec77e5b95b7afd287eb374a252052309c478c2a47c400927b
SSDEEP 12288:VyoKo2JRple9pafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Ss:VyocDApafJ4yL/tNCJPXUQrPX
TLSH
T162F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0500e124884c5b81b940459e24fc39f59d95b29ce5d41e1120a68ce2692b0d86
MD5 5f05dff74a25b19265b23eaa3185795c
SHA1 15dff6b6715632432b4939033c6c4e9c0194effe
SHA512 2ef09a22fdc7c818f9903b318a7d6f7c6019fe28f55ef7f6194869676c5a4fa87ebb250c8f40a3fd499e9e742ef7248dd0ff5f8f4b9d3c4eb1611a721e9ab3e1
SSDEEP 49152:OWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKafJ4klKXnT:o0zuNIsfJ4k
TLSH
T1CBA57B3DA2F800A8D9AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 3c1f53f88c91a3993334835c3673858382b22312a617de889f6afcbe98bcc516
MD5 daa06a444ddc2082f8b868930f881732
SHA1 ee752ef6a743c18073a9aec544c0cf0e04759487
SHA512 5d2e4ccd3d7f4f266f06f709a1b3199213cc0a4494ef39c62b8ffb28732364e4c684b44890f19b46f34bbc0d693f508714e18297ab2f21b4601c1240ca41d814
SSDEEP 49152:Aa0h2GEkuAe73q3ppj6zwwQtfJ4klKXnmdarSj8RoTCCW:Aa0hNYGjJwSfJ4kLJTy
TLSH
T1F1C5D01E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 5d97b213ae8528688e5721ded5a5ce65cfd1dae818ec860b4cbbbf9d3583fd40
MD5 fa6eb85ce0fe6a07da2ea34c8c4d4904
SHA1 03075784c18238d5d6c5ebac6e16acfa523a5c26
SHA512 42daefb63ed4ca659fdfdad2355ef4f8d8623a20e2dca199c25e39b92515a93f425656185de11ea2a6ec7b0f730c057d47a6716fdbecbf465022b2f3bc3f97ec
SSDEEP 49152:lTDxR+N5YzTDjMwfJ4klKXnkharSj8RoTCCW:xu5ifJ4k9JTy
TLSH
T122A5E12EA7E855E9D17E86789B23C502FA727851033293CF42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 4c7721b21c1f208e9e8e07f76dfae6d3020cff1444bc2d39abae7288588bff75
MD5 688a616d25aacb2d845909a01aa40a1b
SHA1 3af00d30b2509482adac55d6ca453aba22ac66b6
SHA512 028c80d0cfe7fb2e9916e8ec7bc263e29201de7578ff514eb033055af043133f7366fb70298eb892500c651689b398e6b0c5f86ef419da60986b5c4c221d5ea1
SSDEEP 24576:CTMdOz0FFS+7mSLVfJ4yL/tNCJPXUQrPTeMaKngL2jdshRTdG1YxITqvfPkbIcbW:O0K+7mSLVfJ4klKXnreMarSj8RoTCCW
TLSH
T1AB75027EA39D14E4E47BD27C9A42D906E67238A5031266DB46D0C0793FABFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 07a4f5c30cb6697fa60fe4b3eaa8492905cd74dcaadcf87a1d01393d491898b2
MD5 32f928d472c99b85ae6382878c3da27e
SHA1 e157d712f3b8ea0c8253935f37b4415dd5016493
SHA512 44c324e035e63bad49ee3d718c86f4e3a84ad5412ced3551be98cc29ecf37b2f7a39184fdc46dc6a3848dad54bf61b4e075cbac22d8c741cf0c9ff1d717e5071
SSDEEP 49152:I4gnaTk46pSR/ufJ4klKXn2parSj8RoTCCW:IH9fJ4knJTy
TLSH
T15395E12EF2F910B8C8AAD236450147B5FB71782D1F2196CB4170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 3a10a2236dbfef5947412043ad5cc7c2c9336bc6b9a6ae8e2eabef75c6e57af8
MD5 3966bed59995d7fa76098c355c23a54f
SHA1 6e7ec64b36670f2193a98b4898c51e0f1a61528f
SHA512 3e015abae8a24b3cd4b914c53947b04d364d0b3739eb0e22c9e787db1d78045e27345124b21de4d4341345f420a294d27bdf40fb237c0a6ee5328ac81b21e5c5
SSDEEP 24576:6sfJ4yL/tNCJPXUQrPZdhaKngL2jdshRTdG1YxITqvfPkbIcbjLm:6sfJ4klKXnBdharSj8RoTCCW
TLSH
T13C65236F63C864D4E826A7B82B68D0059A217EA9130B53FF5CD0D8BD2FBABD5153C700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-146-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1104-172-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1104-93-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1104-99-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1508-383-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1508-41-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1508-47-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1508-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1548-174-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1552-122-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1552-128-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1552-177-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1648-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1648-77-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1648-75-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1648-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1648-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1892-463-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1892-186-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1892-544-0x000000000CED0000-0x000000000CED8000-memory.dmp

Download

memory/1892-261-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1892-196-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1892-212-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2224-180-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2324-83-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2324-187-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2324-89-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2336-181-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2336-462-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2420-182-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2608-183-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2720-363-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2720-20-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3092-562-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-565-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-568-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-571-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-570-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-573-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-578-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-579-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-580-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-582-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-581-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-576-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-577-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-575-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-574-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-572-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-569-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-567-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-566-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-564-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-563-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-552-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-553-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-554-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-555-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-556-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-557-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-558-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-559-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-546-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-547-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-548-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-551-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-550-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-549-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-561-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3092-560-0x000001EEED8E0000-0x000001EEED8F0000-memory.dmp

Download

memory/3308-384-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3308-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3308-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3308-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3324-176-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3572-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3572-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4276-381-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4276-31-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4276-32-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4276-30-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4276-24-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4488-175-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4488-382-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4540-179-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4688-139-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4688-133-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4688-178-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4732-173-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4732-111-0x0000000000630000-0x0000000000697000-memory.dmp

Download

memory/4732-106-0x0000000000630000-0x0000000000697000-memory.dmp

Download

memory/4740-7-0x0000000000400000-0x0000000000C63000-memory.dmp

Download

memory/4740-16-0x0000000003460000-0x00000000034C7000-memory.dmp

Download

memory/4740-49-0x0000000000400000-0x0000000000C63000-memory.dmp

Download

memory/4740-399-0x0000000000400000-0x0000000000C63000-memory.dmp

Download

memory/4740-0-0x00000000028D0000-0x0000000002A80000-memory.dmp

Download

memory/4740-9-0x0000000003460000-0x00000000034C7000-memory.dmp

Download

memory/4740-1-0x0000000002C00000-0x0000000002C85000-memory.dmp

Download

memory/4740-6-0x0000000002C00000-0x0000000002C85000-memory.dmp

Download

memory/4932-79-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4932-389-0x0000000140000000-0x00000001400B9000-memory.dmp

Download