e67a6c9415e725a2af5f8cd89bddfb318270dc5f38d5fe60df7507b92b0fdf5a

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.1MB
Sample261002-e53brsvdnc
SHA256 e67a6c9415e725a2af5f8cd89bddfb318270dc5f38d5fe60df7507b92b0fdf5a
MD5 bad5cfe45d832fef18916c5ec8cdfa91
SHA1 ab0128ea5cd143192a6c4b6392d33c82e7e4d4db
SHA512 f028e3dc6441a193f0bc79297ebc39275ce11b388fd0e114550d64dea8d9d1f571f5a9e69e0cef341214c11a60997a7ceffbd8c935dec637b73aeee93915f53f
SSDEEP 49152:uBJ8GbDLSobiDMcdIsbJdb5+Pl6bJTIZ5jdgp6:uYdVDhIsbbslgJTIZ5Bgp
TLSH
T1C4A506377297D0D4C41D90B4CF160BF595A17CA9C7E59BDB02C8BE25BB326D03ABA209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4988	alg.exe
4148	DiagnosticsHub.StandardCollector.Service.exe
2512	fxssvc.exe
3048	elevation_service.exe
4516	elevation_service.exe
1960	maintenanceservice.exe
4104	msdtc.exe
1288	OSE.EXE
1440	PerceptionSimulationService.exe
2420	perfhost.exe
2724	locator.exe
4220	SensorDataService.exe
2716	snmptrap.exe
3672	spectrum.exe
4204	ssh-agent.exe
1772	TieringEngineService.exe
3404	AgentService.exe
1088	vds.exe
3684	vssvc.exe
2016	wbengine.exe
4932	WmiApSrv.exe
4684	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\61a7a4a8c665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b033c2412752dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000762e3e422752dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af2e5d422752dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a84251422752dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010a191422752dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f90ebb412752dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d19202422752dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edf504422752dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4148	DiagnosticsHub.StandardCollector.Service.exe
4148	DiagnosticsHub.StandardCollector.Service.exe
4148	DiagnosticsHub.StandardCollector.Service.exe
4148	DiagnosticsHub.StandardCollector.Service.exe
4148	DiagnosticsHub.StandardCollector.Service.exe
4148	DiagnosticsHub.StandardCollector.Service.exe
4148	DiagnosticsHub.StandardCollector.Service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4960	2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	2512	fxssvc.exe
Token: SeDebugPrivilege	4148	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3048	elevation_service.exe
Token: SeRestorePrivilege	1772	TieringEngineService.exe
Token: SeManageVolumePrivilege	1772	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3404	AgentService.exe
Token: SeBackupPrivilege	3684	vssvc.exe
Token: SeRestorePrivilege	3684	vssvc.exe
Token: SeAuditPrivilege	3684	vssvc.exe
Token: SeBackupPrivilege	2016	wbengine.exe
Token: SeRestorePrivilege	2016	wbengine.exe
Token: SeSecurityPrivilege	2016	wbengine.exe
Token: 33	4684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeDebugPrivilege	3048	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2496	4684	SearchIndexer.exe	138
PID 4684 wrote to memory of 1068	4684	SearchIndexer.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_bad5cfe45d832fef18916c5ec8cdfa91_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3852

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4104

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1288

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1440

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2420

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4220

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2716

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2840

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2496
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2c8a72f0d468f8fd37a05766c8b6e6ff3b888e9295f0570449180cc3cec1193d
MD5 1d671b2ebbe13ce87e42239a60a4671e
SHA1 6671052221c7db3ddd6e9b2aa58d4be6c5b239ed
SHA512 e8a391f033f8e77aabbd7b6741af402fe9e94a15f7ca1e662bc989ecc12f6fd13570d646159db30a44c820054dce809eb1d89a16bdd55ffa626d246f8b8be751
SSDEEP 49152:sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnqb5+Pl6bJTIZ5jdgp1:W3q6mjBJslgJTIZ5Bgp
TLSH
T1E6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9aaec43c70e55a05a0f819ad9d569cb5ba15eb830ecbe79cbd423f418882a275
MD5 491f1b8b37b4bd2f2ffe1c5170634c1a
SHA1 441973c0664a80b1c2c65890a9bfe98d07b2ff8a
SHA512 8da1d24ac6a6b4d64258a24dc0cead3bae2767fdc4fa817d5735ea1b075deb9db1548b6ace5421a7555568010d59ce1e26382e0f8ed06427e0c0287651b6e094
SSDEEP 24576:HXYfDtczAemb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:StcMb5+Pl6bJTIZ5jdgpq
TLSH
T19D85F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 accc7f58501604b97726363eea2c658bf2b5a30ae79cd982f759659afe756fcb
MD5 bc6d5f252fad57da493e202d9ce7a4d4
SHA1 6b2a6b6d93be1703f0a626c9205fb463281e54b8
SHA512 747d175c170b5da536e3d959200b71d79869c70e3e7bc75e7c884b61ffc968507202753d3e27cc8ad06efebdd6a5873118127d6e570c53264b027f8630ac9b20
SSDEEP 24576:e0Le5ji0hmxyrMmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:ePji0AIsb5+Pl6bJTIZ5jdgpK
TLSH
T19D95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 43df506a4a9af08b7d877be914198b30ca1cf6ccfa318dfdeb033b0a7f8038cd
MD5 5bf9b945aa69f721a55924861713764b
SHA1 8d1718e221df3a0683a8307c8218d66da4991d5c
SHA512 8dc9369a004518dd6a269c1b571faeca785e3c158c6b0f9284faf84a47b5de2a6255b82b5ec2e095ec887c15706e3122345f9694371d5c2fc526e96e93b93dbc
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWj6q8wyuomb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:6/ezSC6vUzPv+Hjywb5+Pl6bJTIZ5jdp
TLSH
T1AD756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7ede40a252f3ee483a9724e5a5e3ed5fca83a309ab2d84a114ea3ce8580da0b4
MD5 2dce26e1455ebfc993f4f5c9bcd56932
SHA1 9d7f38aeaa4e24587d56390e2cc86803b7de078e
SHA512 f6344020b1f8eab70fe776d70a2e6ac33655a796ce31d25b140a745edaf4ccc44454e0b3931cdb947e74753b0e033a803fce8444c59ab021521c41b27b80bc49
SSDEEP 24576:pVbqPb88hv/l+Bfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:pVO88hXl+Mb5+Pl6bJTIZ5jdgpe
TLSH
T129559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 07e869e7346f7e5ce4c85d91b10fc62b5e84ba74e843ac52ed168d62da5d1232
MD5 7bd21bd2fc963ba41945d08b2ba79fd6
SHA1 0f9a6f98744b2c6c47a91d9322d75c60f901078f
SHA512 3895afe130df61ad36fb142d3835e00deeebdbb61858fab11ccd200d5c16c006e18ff9f4761390e58d78823d0e3425ccaaea9d23efab6971afd47dd75658904c
SSDEEP 24576:bFamb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:Lb5+Pl6bJTIZ5jdgp0
TLSH
T1E46523834B6930C5E5AB1739E9CDDB00F879EF55CD866BB6C579282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 128daad79cab243b76d66ff8fe6c02ddec3fd1f33ed578efdcc44c7d979a8cf8
MD5 e3d1b7e9cecc65be7963e1128e11898e
SHA1 b7a8a036c6710b67c7d4e372fd60c9868056603f
SHA512 887909fcb8b57cb660f45d95b60dc097be8f37e09b4d0611c1fa1333bc26873e7244850dc9c3273098cfac68867c7f911ee0cabbd252d1db94a3a9c348536d57
SSDEEP 24576:jJIUnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:jJIUmb5+Pl6bJTIZ5jdgp7
TLSH
T1C785CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bc06af8dddebe6ed6e967f6f459876762e3bd72a2df7ab0e707d57497c807496
MD5 138ada7cf25f4a39e81ad807be292572
SHA1 91d54bece7cf9575a32b35af8523345f3de6e96c
SHA512 65c95331fd0bd6ee2367758de21a86ba564d72e71150f75723a2130262e263095d79cee5d85dfa37e1df4fa9771853585aa97d4d7faf01ea0dd50d4e43ddb4aa
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THF:IQvGAdlCEL8c/WRNw5CzslgJTIZ5Bgp
TLSH
T19F266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 4c0d732bda38e918ad42eae5fd8c4fd79869a8969c13bb1a1b91e87664b87059
MD5 3d381392a4fcb30664900a8e4eab59a7
SHA1 fa225d00083bb3c3a560c667e09e700611f22440
SHA512 e5ed51bf41e1b7c55551c256f5ce7155140727c8f7b5d0d3262c01cba88267a45e72829b39ab55af037ea478d8af93a64765a1329ef3218c1023ae4c56d1a415
SSDEEP 24576:JOewsAjBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:Uljcb5+Pl6bJTIZ5jdgpm
TLSH
T14585E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 71d9711107579aea1fe8c11b4c4329deebe13abe307157dec25547c0ede0a2aa
MD5 44b46374000f3e8dc953f746baf043df
SHA1 7afb89f16d2ac2572b1385d5dc6099b736af2c8e
SHA512 b1ffd52c14d725687c9f439ab4e957954cc69500e20a36dad5934e4a74a53364e570c1b3e5fd84d8b37f88972774bf10ede1a6e832a8d23c6f6becb8b314177c
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHCsT6p:AUEtQevvqc2W1cpV20I32Cs
TLSH
T111474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5612fbd4a3707d5d8e28f7664589d6c3c6d89f24ea4973980668102a57be1651
MD5 a5a8a411c87ad2c3528b9c2e016eecb9
SHA1 9e6c6ffbc851d4d45296988eceda88bd5805cb4b
SHA512 fdade5bf91fb5851a3fc92b1f9d51f223130f563c25c69e1acdc39af1e47346ac2ab263f6099b1cc45f0b2bec8da60a372fb1062a3d825665de026b2d5376269
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/z8b5+Pl6bJTIZ5jdgpE:RoqtVjnmHslgJTIZ5Bgp
TLSH
T1E5D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9650ff2f55c7c598bc61e1a537b4bcb1195c723122d0283df6a25c5ada734df7
MD5 8effd95ddaeb42945ff7e24d26d16a25
SHA1 9ccd8533748002cdd3fd4c977af6f81864ac80a1
SHA512 5c901d491b0340f02daa6440fb168140606de1986748304c3142df3dc4241ca14b1b0e5b2662a719f8e44b8cc35b33731396cea4ec7bd9910e3a72888350e462
SSDEEP 24576:hAhGL6IFoiwtA5l7S530mb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:hAM5Foiq5Tb5+Pl6bJTIZ5jdgpC
TLSH
T15B359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 ff54713c8014f51b4d95fefb2306a81871b2c4bbf7558b2188c6171b89dab4e0
MD5 bc071e38563216c343b21ae4006318c1
SHA1 c7481b806f5b3f29a5225b851bd0f672b68f467e
SHA512 07058b1bb04437b2fc4ab60444ad85505109bf74807288b31f38ebd562c6c6cb45572b7f7c9083f43ffd6688cadf6d0b3a8735ce51abb4f577f048cc370f6094
SSDEEP 24576:2wuGOWsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:2wNOkb5+Pl6bJTIZ5jdgpz
TLSH
T17E75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 506c5de14ef05e40f7d932c6ed4621331d8cbab4df23a49cabd36fc5d3838c5b
MD5 aa9d64c12859bf2139339f491a59953f
SHA1 79bb49490063011cb47361e24a2166efd3419257
SHA512 9677a63e256e22deea9cf10c6be2b7c866b3bce877e6f89c776bc1f4d3917aad3a12d6220f3d4b71a54c23c3d22701fbb2d687aaa85aa1fb29a2df570ccf8251
SSDEEP 24576:HZuOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:8b5+Pl6bJTIZ5jdgpU
TLSH
T11365128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9ae183b6707cafafa0143707e370b95738b77ac3b52e504646696ad0a0491ae3
MD5 01ce1cc5b490a34d00f096ada601b8ca
SHA1 9c2df0f671bd221b7dca6e5b657fdb169abb410c
SHA512 5c1bc451764340ab696ca5746155d1350c35080e354afbeb133c950514e025d3f619141517b45657a761949a4eb945e00800a78c09adc55fcef087d3d7d451aa
SSDEEP 98304:9QRQyi36YOcPDLvw2gAf+PN3gslgJTIZ5Bgp:0QyiKanX+PNQsT6p
TLSH
T160666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 69157538a7f8f49ed7defaa4ab1e03901932f80aab89c3ddd5bee969945a10f5
MD5 f63d4352e37324d2505f2f586acaf2e2
SHA1 9d3ce13e4053fda2bf174de93cbbd6f84d111ec9
SHA512 cebe91af2ed6e199d193385a88d41585f9988b0d369a450bc8b3c1fa1805957ea1d12b3bccce4487969672fefd1c6310a7ceadf074a366421586a1d6d8b630bf
SSDEEP 98304:GQRQyi36YOcPDLvw2gAf+PN3gslgJTIZ5Bgp:tQyiKanX+PNQsT6p
TLSH
T118666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 76a0c5a31a2533aca30ce1a3f91e5af336b6fe7db3d24d2322a38c7a50ba8490
MD5 f189b25a1e1f0b6597329f436591ef3d
SHA1 94fec54aaa93aec99bfb876ee15f2e49ca0189f3
SHA512 ac6e5d26ee6a681e1800d2282f43a0e99d7a3447b20b74ddfad9e28075772b3036bdb1aa330cba92f8fd619c13c5b17ec6df0f3fddab73f0ac797f41c22b00dd
SSDEEP 49152:O68Qg55nhkeWu7PNU3/sb5+Pl6bJTIZ5jdgpn:cthTRc/KslgJTIZ5Bgp
TLSH
T1F4B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e5bc030afdd09c553c3c96c9dd645e99869f6b52fb6c3a2d9b97c871b38ef515
MD5 7e2e7bb91840487d85766f2ce383bdae
SHA1 d10335728e316afa71d854a25363deac886cf154
SHA512 5799e0fc86ba6dfd766f1f10a11d26a502cf5bfc31960be1fab70754bd15262226237f3b663e644dbbc4b4e4fd399716899abec82054c243e597143ac8cee91d
SSDEEP 98304:4y5112gYy5azzVvU69nLKnhZBslgJTIZ5Bgp:RLIHRWhvsT6p
TLSH
T178167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 35f96954ce599baa2c7e2abf00e57df043d3bc64839f4f00b2ee67e35f9b2a1a
MD5 da7331dcca9596e72521d8eed109c2b1
SHA1 aed3b2abc6edbe66a3d39d55242312d64dcee22b
SHA512 ebfd8d7999cd7542875c236375ccaeaac2f305df5c2f64617a0f00bc3a225d1538021aff877029741e504d2ecf78cd5939bf980f28adc459b8a29be1cc0b606f
SSDEEP 49152:kB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glxb5+Pl6bJTIZ5jdgp/:+u6JmIxd2dtslgJTIZ5Bgp
TLSH
T108D59D13F1DA01E8D06ED478974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9254a16e10b06088722f7fb34b8c477f4654efb104d02dc77d120e6cfd834c9e
MD5 4a8193815160db3643a952b7d4a7d934
SHA1 9749ba904fe516e4ea1ee525d79773218316c3e1
SHA512 c73d0af7433fa41377c6acbee7b1aba1ead3691b5ba55d58aa90b739f540ddaef293349dba6acd3615538645d89c40ca836a4d346f2bc2ebf8c6557a2b3215e1
SSDEEP 49152:h1hpsNoJpF1A67U44CwH7R4xGb5+Pl6bJTIZ5jdgpt:hmifPqRHslgJTIZ5Bgp
TLSH
T1FBB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1c31e3cea42e1f99f361ab2b71acf85e5cc9adfe688be9a20f2f7ff2dcc195a1
MD5 dae3d8d01d6d564df09ee6e747d9cfad
SHA1 fcf97bd2daf3c2f2838f37e47a12f05f1debba46
SHA512 6567b3e8703a936365e323c2da975df27cc14e8c91324da117ca31629f37038686ebd387c5c7ca7677c02e87b90956e4ddd82756eae3ff024d4556520c7c238d
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHqxb5+Pl6bJTIZ5jdgp+:t5dKqi61tslgJTIZ5Bgp
TLSH
T117C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ff1111aabd48fcbaecf165a0e248019a53149e32d5851097b27841b04eb53d3e
MD5 6e45bc32d95f10689d9191bb059bda06
SHA1 6f79284b310d647912e52ab94137dfdb3eaa8ed2
SHA512 057cf1436b39485860fb83b447c79a85461d256b8c08aafb0bf95dd7f2b01ede8fbbdc6312cf840ce7e47e64563e23473d1a954725655df7ac06405f000f7ecd
SSDEEP 49152:ehtSn8EApI0figjgiDn0AP5wib5+Pl6bJTIZ5jdgpK:/X2iWphbslgJTIZ5Bgp
TLSH
T18895BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 263f0de7e206b2b809815bbe530cefbc95f62c9177dd82c4b47d496233e86890
MD5 8410244825baaacf27d5ad625a19747a
SHA1 f520b63b434216da5d321b8f7843573751d21975
SHA512 3ff0cf092da69ef781ba6a9378aa003d15386bdab55e7a58dab5f4ab66c5fd12879dfc193422c823c5b2c9c03747dfb82ebd6cb3c83cb56d1bed30a6dc847aab
SSDEEP 24576:rCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:pb5+Pl6bJTIZ5jdgpC
TLSH
T1E8652386496B20CAE09B5779D9C9DB00F87DAF97DE8727B6C67D0427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4f8efbc00f30e6362eeb9e84fa9bbf0aba4bd2a88b2392733a50f96407748459
MD5 2b5882bfb9cf32b1b24edda168747ed7
SHA1 94056370849960fb39278c890a5a64039dfda40d
SHA512 678aac8ba4a5f9cd14d720b0914cadb8230bf9480d3155042e7190808bd112fb24b69bcc7bc54310f5f9ee1004b4f95e1a311a2edad304e457e16f8b13690f83
SSDEEP 24576:6Fmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:Lb5+Pl6bJTIZ5jdgpo
TLSH
T1246523824D6B20CAE05B5779D9C9DB00F879AF57DE8727B6CA7D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d88f352b899fe81bee23cdd7d75cb3d956227774fcf398b3ef5d93d246b55a2c
MD5 d38fbce36f9077dc22e3537b1460a082
SHA1 475b1283b805ab40123ebca14c263d5133a81934
SHA512 e732be1f3dff7c50151df2e6b26ce3b5dfdf6fff75c291da57a34f7a21c04a461c882026de49d7e0ef0cfae02c9233ee85ed74a95ab9092de7ea48875d5c3d9a
SSDEEP 24576:bvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:Kb5+Pl6bJTIZ5jdgpo
TLSH
T1386523824D6B30CAE09B5779D9C9DB00F879AF97DD8727B6CA7D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 7627d95672919fb5d338671f1e62a30887a2c39b7c578c2aa8d3bf3232890362
MD5 a8f3303af36ea0ea339ba0128aa81859
SHA1 9a7ebad8c05b2ff42d9b315763ea66ad5c8a97d3
SHA512 7ca59449ae6c1aee11de1b586abbadc8fe416e93ed1c5a684a3bdaac157c66ff47dcab8086a5322ee7e7a4db478e032f75863cb609fe3565bb4561ee28b8efee
SSDEEP 24576:Dmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:ab5+Pl6bJTIZ5jdgpI
TLSH
T12F6523424B6A20C5E4A79379C9D5D700F4B9BE96DF5267FFCA75082BA9313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 079277f50f121143b83a0eb879e1f24c0795862d71780a01316fff8ec0d48ef0
MD5 9d9ccc62c8b1e5afa1c8e5e4b4c90c3d
SHA1 0dda221536171a803d2dc1be08f7a03f781f7d77
SHA512 070bd5ddfec0af1273e9afccb76c40b371061b9baeab3521f1041db738f9c98222a6a1466bffb06d54ade728e0fde434f74a13a40eb8f155245ff44f9a28fee6
SSDEEP 24576:1smb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:Fb5+Pl6bJTIZ5jdgpL
TLSH
T1926523828D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C67D0427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1d2cc39e12afbe5c1dc7669d92679d734ff5fdc798f21f12a6b3a460cade61c7
MD5 828529cd22edbd90292b1fe78e8a2186
SHA1 31cf88eb1a18691a0e05944da1a66a79cfad1cc4
SHA512 6465f2d446a07c02cc906cab2d2ea2ccf63fb8474a59c4514336d62b2060eb2400845bd0a215e635b452c3247482e6eb3346e1667679300d5397fe7037915ff5
SSDEEP 24576:UJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:bb5+Pl6bJTIZ5jdgpL
TLSH
T1766523824D6B20CAE05B5779D9C9DB00F879AF97DE8727B6C67D0427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 848606c0d8e24839ae14d7bab3ed6742542004d064c9cbda29ed0ecc8879712f
MD5 079f1a1466b7ed6430c5e77656f3c89c
SHA1 4d834a2bb97eda87b0ecf998a12a3dbd7866f728
SHA512 4639582c303d9da7ad50d48fa79d8ab6297b3c403b7429dbbf450ea9a6ab5dd4379b88340c706bb88656f6b4960c9ed45df85e1e94aa34bb3d836c9c5c4ccdec
SSDEEP 24576:xdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:yb5+Pl6bJTIZ5jdgpT
TLSH
T1426523868D6B20CAE05B5779D9C9DB00F87DAF97DD8727B6CA7D0427F134389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 142db3eca260b7cf84713b5af15946887b86aa524bb7b5f66799b43373caa843
MD5 ec16d3f9bb11de406232e188fc811613
SHA1 479efd6a0f29f031eafd1f8313f68a21d06b25ce
SHA512 5c08004b20223f9616bf11c4365d04e4d667017e35dd741b745436bd9d505994a68bd23665ee40ef0094567d48ec2d02f3c2e31c1f69532814e5ecd25a3ecfc2
SSDEEP 24576:OZMazFVSOlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:OZMazf0b5+Pl6bJTIZ5jdgpH
TLSH
T17885F295B39018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 bbfa531ca5f271d6b23856d63f7d61ea4ff4b193f6d477d53d1ab66320c6fbc5
MD5 e9bb52dde8ad13d2661242bc5e9230d1
SHA1 7ec850f3887bc2cdb0c61d1c094877656b59405b
SHA512 a245d7e4cd4d823253c2521f6381dc24d71453a72ed0a001a3170bec302aa7bc7b25bcdc2c7de1968e5334c72f839b6381d399b5b5407159f1f6a535c7cc9668
SSDEEP 24576:4+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:Kb5+Pl6bJTIZ5jdgpx
TLSH
T16C652387496B20CAE05B5779D9C9DB00F87DAF97DD8727B6C97D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 538a9912525e7a037eb4a3de9879ca7435338916735f7fc3191419816b3a046a
MD5 712f1e53fd4403bcd326c4b7e920a801
SHA1 f35a29fc6032fa5c40f2789c9e69d2610e2284e5
SHA512 93b9d4e7168607076f46eebbab6b37414ab93e2871074b3feefc081b08b13905890ae623cf5e0eda26ebfbb3384e7a9f27c4fac0e8663b7b17229ffe8abb2156
SSDEEP 24576:jKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:xb5+Pl6bJTIZ5jdgpr
TLSH
T1D7652387496B20CAE05B5779D9C9DB00F87DAF97DD8727B6CA7D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6890ab035b6967a9f7dd553c89c3cbf6523cd016828ae3271670fe4001822628
MD5 f1787961aa3a6365d8b8a98de630a025
SHA1 d9b251a2c89ebb7729b365621430b157abad4558
SHA512 64984d5fae18d0ed1a782fd52330b33f712de109979340f728fa5df38d1591cf86ed3425ff231733d6089ffe06a984cac47c9e7f5d46350de360b3b20f4bbb1b
SSDEEP 24576:Rzyxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:Rnb5+Pl6bJTIZ5jdgph
TLSH
T13175024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 164a886886d3ecf40a36c916f7df730d0835bbc9e5110918a3af9dcf32985a7a
MD5 a650a5e511d0a176104a578108d54a33
SHA1 3129a0aa7c27470bcdc37372876d858d3dc357b4
SHA512 8cdcc48e5887795a824c014beeefa232c9442d16ce9921c91d97f98056a4ee36b54e2890b1536d45fbd6747721139e51b92b0337b0697d50509f45f45da634e8
SSDEEP 24576:G+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:Ub5+Pl6bJTIZ5jdgpz
TLSH
T153652386496B30CAE09B5779D9C9DB00F87DAF97DD8727B6C97D042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 87492c486ee83a0611b745016ddacb0583f09fe6d38fa7e64bdd8dab205f4336
MD5 af560c18e85fdee489b71de01572e668
SHA1 fd66e59ec7c6051ce0f586ee2fb8f70a28dbb9a8
SHA512 408033e5f3cbf86651b9227b0d2615e9030f3f1197efcc5191e4d424fe7391f01a2ffd7fbe02811bdc25c5292cfd11d594bfb4b2cc4180bb470400b72f464138
SSDEEP 24576:n+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:hb5+Pl6bJTIZ5jdgp2
TLSH
T1D8652386496B30CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 633ecf0f75ba366753c5fcf1e65ae318d7dd0472a6d0001ee3072599039365c1
MD5 0d7efb194753f74a417cacb25587786f
SHA1 2663a3ec580bba604096d6fed619c3cd00791539
SHA512 7e9e184e1106a256a250807d6fe30d3b713e3a38db47f965fd9d53c6be5097d7ac07de1870f37f897879baaf98a54902e4e702e9786fd44634371929f6eaf389
SSDEEP 24576:gzyxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:gnb5+Pl6bJTIZ5jdgpM
TLSH
T12F75024767A630F9D0678239C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 9014e28e9d8f23f79041f1f79a1584583328222ad65f74dda1ab712450e6d0ef
MD5 e34269ea9415529dc182962e44aed808
SHA1 eac70e7950294aba5ed9314ea5bbf1ece741d203
SHA512 25aeab7d27450a5f578644fded6c23e2abb78043d04e73aff14afb52ae81bc0120cc3434c4bd6aa30685119641e9e5351a72c424946ed3d6ea0b4d3ad84e9495
SSDEEP 24576:lT/aLl3z0zD/mb57GBiOl6a8JTth/RWZvR6wQQ92pN37:lTiLljfb5+Pl6bJTIZ5jdgpd
TLSH
T122850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 ec3a42191c5575e1f26133ffe6322f943d7616b6d36ab6daa5e7053367dee897
MD5 b90d48afe861eb1091d60db1dcfc41a8
SHA1 639f35033b07dffc1d5527e1d590d6554b7e75c7
SHA512 4a02be426b8c23ffcc563e0f7c6cb2e8adb4d583d863dc5ae27a409c059bc6a31c89611dcdb2c358d11206d6cfdbc67b4e7dd7371f12cd1b142040a9691dc0c6
SSDEEP 24576:H3Ud9CHKy7GZzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:XUd9CHKya0b5+Pl6bJTIZ5jdgpp
TLSH
T16595CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 568f6d13f5fc9de20197aef50777e7a7ed87d0c86f4f1d3b730a24576a38c4d7
MD5 46271f4a7f631b288a3ffdfc1149bd20
SHA1 e1b3c8eda877c0e36130ce85d137106015878010
SHA512 eb53220f9036b254e01a5fe9c75f9faa04ae82de50a7837e70ee2feb570b57fd9dac4a7222baf5a23dd26b2675db05376dedacb40401bab13936ca475f7e4aa4
SSDEEP 24576:6Pmb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:Bb5+Pl6bJTIZ5jdgpr
TLSH
T19C6523828D6B30CAE09B5779D9C9DB00F879AF97DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 319ea6a56ca2a302df96097a1b1692fb5d46deb211ec95a18064aacc0ed79384
MD5 f5c7a9fe513f2ef238a1d11e1d253755
SHA1 85a73769914165c47a01c5731623b374c9bdc195
SHA512 f202ec44f95037864ed7107c5c37fe0bf9db2fc3b75142260731a60154587038efbc41efc12dfa87b120be0572a563a8bc73f6fd57e75cbaf5641e7c3c27a6dd
SSDEEP 24576:tRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:6b5+Pl6bJTIZ5jdgpH
TLSH
T12F6523864E6B20CAE05B5779D9C9DB00F87DBF56DD8727B6CA7D0827F134789381220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 3778b1fc3772c30758793b38f3cb4927c707ae2638555919adb57d0efd045e34
MD5 98821065079df546fa5481e39061be3d
SHA1 0136a2c18773b897fdf9b80668ff56ce71311c10
SHA512 a0aae493e205b6e1b97755cef2e91596c4770a28155481a2699a41929f9404a6090708c67f75b625a0e1b49292492c2ad164e8811f5b6df14911b1d98ae4356a
SSDEEP 24576:kOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:2b5+Pl6bJTIZ5jdgpu
TLSH
T10875F14AC29811D8D06E6279CB858A00F7777D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 cb095a3cfb325d4d42b5ffdc500fb7c6337fdccdaead7fa4d6b5b66548064000
MD5 096fc609c248fc877c83d1edcc0471e3
SHA1 70b6cbf52f2ece430ff6cd2e30cb5295c940cd6e
SHA512 4007db626142d7f93977194a7166e1d4c93ab21a3a50f137319e609de58a4ec19a75032f8be32241ea4afe39e3d8f174f71e7c7cbaa5e76ac176da0bd8816cb3
SSDEEP 24576:aNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:aQb5+Pl6bJTIZ5jdgpu
TLSH
T1AB6523468B6E6086E0BB5735D8C9D710B83EBF65CE8666A7C579142BF1307897C2230F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a8658f0ebf12c881f7ab3f5bba909643b7064b639af52ec1a390bd30ea22c24e
MD5 6c360ae5942c03e13982efd1af15e5e8
SHA1 7d2e793a960544740d26fbf039422bd2b9664f75
SHA512 4590dfe77a6755b40dbff60b3676bb348e9d5abf81e7248639cb8bb183f5cd013a0dc73107e098ef8c41507fd276a96906146cfd92e6ce1f7b514eb5f10da53e
SSDEEP 49152:/a0h2GEkuAe73q3pp46zwwQqb5+Pl6bJTIZ5jdgpA:/a0hNYG4Jw5slgJTIZ5Bgp
TLSH
T13485AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 fe1001f120856ad1dc88abec79e47f576d147e80ed6c11b8ce03dd34ff5ffed4
MD5 1aa6713691882b6b30454eca5b852dcf
SHA1 ad2e3499b778ccf34743086305332823eb52c21a
SHA512 07aadef92d522d5ff1435281a42cff1d0c2ac6c9b5b944e2849732abf01c34ed2d200c4117c22c67c013de874985242694a8e1eee35abf4138b6fa7138ccd109
SSDEEP 24576:0hbHjP0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:0hbHjrb5+Pl6bJTIZ5jdgpi
TLSH
T15865126E06AD20C9F076A27DC5C5C606E731BD265B1263EF42E5813E9F37AD82C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 ec7056159a9f5e1eb688a981baffa45ea75aede3d79b9217d34bfb070ac42381
MD5 83e567163d2b2390705d1e27d26d1759
SHA1 c34f3bfd776d4d63b7620ec498285cbc129c5554
SHA512 e9c478ae63cf0f2aea3b1672c6183c741f65b2ecbf95c548fa48d5da86882bc7e00ea16e4c1df9b0e7e52950ce7058e06c3b77defc31ff6c051d86090794b900
SSDEEP 24576:4pmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:4kb5+Pl6bJTIZ5jdgpx
TLSH
T1616523864A6A20CAD0AB5779D9C9DB00B879BF55CF8727F7C479142BF1357C9383220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 098023977df6af293bc14cef9d8e2d82a1d2061a5c0f6f9d82752cd5ddd767ca
MD5 cceec4108ee931584d1cab656d97776b
SHA1 834a2a85efe43ebf0536866738deed76effacb46
SHA512 251851c03bd30773a2d29d3ca5c8a1828107537904e5b1d8c8bcf60ff1db6bc2f259fbca3b33cc609960532dfa00298131e3491453b0fe122306f529b846c25d
SSDEEP 24576:0BL3UTUmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:0BL3U3b5+Pl6bJTIZ5jdgpC
TLSH
T183850245E7A500F9E87B823CC8A6CA12E672B85D0754E7DF03A84A661F233E55E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c0f3be1700c4f50f8199a5bae5b383c91a6b8a957d1633847ec15f5cb39dc2d7
MD5 b7a360d0699a0681c648ac60bb297920
SHA1 0b1441b0ebd3b8f1a4060ae8a91efb6fbbabe078
SHA512 5e01df57b6d52a389a83f39c2fb80980fdccfddb305c1c3943d863d9d02ada47cf0101d00fbad23ef2eba07f1737df6168288404290fb672778cb21c34294de8
SSDEEP 24576:SOqmb57GBiOl6a8JTth/RWZvR6wQQ92pN32:SOVb5+Pl6bJTIZ5jdgpA
TLSH
T1E575020A27ED20D5E076A23DC9C68709E771B8664B1257EF46E0407E9F63BE87C36742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 708389b33e590c21d5ceb1b55f05b376f57a987d5f369e207f70b87e0c3e872b
MD5 4b717c79738ad962b287c2dfd43cea70
SHA1 97420f414091c12a324a1003c982c00221a71a6b
SHA512 03592b7af3839979a0c6949bb7077fcf2b58f58b1a7f9149f19de45612d8016ed75a4af5f68d18261deee8323c878c782b63563dcb43a6a58f399243d4819aa1
SSDEEP 24576:T7NM9YqZqmWMUkPjZM48Mv6bEhs9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:T7cBWMpPjN8DbEhhb5+Pl6bJTIZ5jdgi
TLSH
T19265AE2E6BAC81D5D477D13DC9E28205F6B2B4611B318ACB1162833E7F37AE45E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7f8d873ed3be23779f19e3ca2f8f0a11c52fd1eacac82b6246b76e9935b53f4f
MD5 91a109c5b70e238e3490317cfccbec23
SHA1 d3a673570f929153a73dd5b44cf2927275a3a3ce
SHA512 73df0fac6893f17e2940c3ffcd3e4490d76367b042b23ff43743cd909e82ca3e13b2402c6848e005becc054a89ea8c463cdc55b107787b037ca97339e662075a
SSDEEP 49152:cF2YuHNETovAvNYf8kmgb5+Pl6bJTIZ5jdgp9:56BCf8krslgJTIZ5Bgp
TLSH
T132858E2A27ED80A4E0BBD27D85F6D246F9B2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8ce44b22205f071b11c46f71536f5ead1adfcf44c177bae0c9f82b59e3dd42d2
MD5 e6c795de14efcba2c7697fbaa88c798b
SHA1 d1bf890d4efdb267f6294558505aa5a77b57885c
SHA512 fc247cdcb50b52c8e77cb629b7dace57ed5b1917709142fb5cc2e60a60ba1322abc7e5981f52369b040ea19aa79b298966cd5497435aaa5d9ece97a656e9e91e
SSDEEP 24576:lAFs06+Omlf8NXEbToMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:qFs060loXuKb5+Pl6bJTIZ5jdgpU
TLSH
T16B65BF2F66EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 7ecaa2ddc26bd40458df435677271c31d0c5e05ab6b17d45d4f8629a33a534b3
MD5 21a385b9e0e85bc1b5f4654f851e0e5d
SHA1 9d3410447c53e4accd4285ac01c62c4d31daf219
SHA512 ba804b138c7959367cb81de9334201293ab21594644218457463df34fa5c0f3f74f57d561d0ff81bda68b99dd1e7d60bf2fcfbc0e03bbf34ae3c27679a1609bc
SSDEEP 24576:NJnJ5D3Wxzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:NJnJ5DGxKb5+Pl6bJTIZ5jdgps
TLSH
T12985D02DD2A810E8D4B7C274819A5B45FE72387D2F226AC758B4D4357F12FE0A979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2f97230678fc791227731f50e02fa13aca750aeed568ab4bada2e985eec4b723
MD5 83c690a48f1f1b8bd7ccab1b6cb11227
SHA1 3add834b7bc45e1d1951caf30c5e85ea4aa8cbf9
SHA512 6480babd0b5b9e12b040110a01700a13fda6acac1718db5e965a84da9d4498bd38154cc54cf1c9d7af4cfd53a8f02327c5d7418b7468026cf7538e28954a3b60
SSDEEP 49152:qg06DIKdwc+eQnSt65aV8b5+Pl6bJTIZ5jdgpy:DsslgJTIZ5Bgp
TLSH
T10A956C06BBEA5294E8B3CAB1C96295159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 5bc682da27ef2e8c00edeb891051168a2ca737dee718b694264d61d7b51f0b0c
MD5 c476ad043b6e8e76651b517f30160ebb
SHA1 4dc9937de43326ca9811c0260c7a8122d1a50149
SHA512 ddf2d9de911336c04bc7a35c1a2248f0d1effb18c9c1c45c43f363888490f8990f38a1fdfe975d4cb72c342f66ff379ae3b85e547a0d1c786ede9fac934b61ba
SSDEEP 24576:j8hmb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:j88b5+Pl6bJTIZ5jdgpV
TLSH
T19365015E1BAD70D9D06BA23DC5D1C704E3B2F4619B4227EF46A1813E9E33AD92D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 75f931336b483553cf2819d6f73f1eab2a756102785d87a38b202d438685ab90
MD5 89d811a7944fbdb2401d8a7e3dbcbeff
SHA1 e79cadca5423df13d1addc3574ecb41b2e35b7dd
SHA512 82286c9812ac2c1be98c85b5ec95d144be44d8332675ee5058bc5b86d0063504771d94e89f6547eddad801d52d8af71dc8f62ca3e209a1f905ace27d020aaab2
SSDEEP 24576:hIyEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:hIYb5+Pl6bJTIZ5jdgpg
TLSH
T19C75124557A860C5E5BB4738D9E6C350A979BD20DF1263EF80A0A63FAE36BC47C31706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 d9a468cb7da4c6ca956ff2fafcf95abdc12b869ca24911243dc78e0f1731d364
MD5 75b86d51b9ce0eddfbbebc9536540fff
SHA1 e51059dd64082a511dbe2db6d05bf30bb03ce76e
SHA512 38f381a7710e6aea78eba3910fe2bdbe9ea867509aae7c74930447347506ca3113ab7bc889c2d8c9c8ccfe667fa3c6543548d83aabeb51063901e747e58437c4
SSDEEP 24576:uwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:unb5+Pl6bJTIZ5jdgpN
TLSH
T18D65234A4A6A30C9E4675779C9C9DB00F479BB65CF4636FB84F8943BE2317C9343260A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c44f2c648703a75d708557cd0eff92bb4eb9b8254fe3fbba4babd86abbfc2b00
MD5 8777801dfa2ae28c09ab5151cf2f455b
SHA1 9012c60ad644543718a99676e8c89c9052ddf791
SHA512 dc90a8a3d2fa0664a8f0468f320a2496ce17e580ed239ebf4a8519f97a97468e631921b1249e6d7f514570836baa8ea0a380327d459ef130233c2d6bd3dea4b6
SSDEEP 24576:MQ9MxZKdcz9dw31mb57GBiOl6a8JTth/RWZvR6wQQ92pN36:MVKZ4b5+Pl6bJTIZ5jdgpE
TLSH
T1B5558C2DABE9058AE177D239D5A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 935bdf080c788b4156f7eed0221c401f620c61701626be262c84500a1e2ba81e
MD5 b8085d48bd37a253f5b64ed94f3ec9e1
SHA1 540021256c342ddb123498e7ff839d827bb0742c
SHA512 07e74d2117853b836445f390b8bf1e060308592a70cf745e0aaefe37ed6b973b8c5ab39214029a313280d513b6137254166a0a2bed2dbda31caa77fa3f6f1f30
SSDEEP 24576:kyocwAp6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:ZocwAplb5+Pl6bJTIZ5jdgp8
TLSH
T1B275E00FBB6A40D2E066823CC9858745F773B4309B5267DB55A1C33E8E27AE97D35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 44ecd188443f506bf64bde2f9d05aad403412e65963922632cd6bcc4b144f126
MD5 2331710c13f03d724721b5a45ebb484d
SHA1 bee0437a71fb96dc569b511897f2afa112f79077
SHA512 7067a8321f2e878609f66a0a5bcc4c5c168d9c2c081dc05afdd71317450874c1c601a11274d8134e22db56ef0c6041f6ca0807d05656ca7f1f75820e3b14c774
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKlb5+Pl6bJTIZ5jdgpR:i0zuNIHslgJTIZ5Bgp
TLSH
T19AA57B3DA2BC00A9D8AAC379C5451365EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ae562ef48aee248e58dd5433990195863e23b7474370318b29040d7a8b6ec4f4
MD5 d6ef98d017d35bed39e988d3a8483755
SHA1 6a61a627b27649e7f387db48915c8e7fdd36ce5f
SHA512 e2229807363cbe46c0fe269c08a10c4856e5508d76cc6bfce6708efa81f017f32930d3ee6ba910cf7b0842111c31a330beab2f48ccbbfcca4b594d513ade7bd1
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYzjMqbhmb57GBiOl6a8JTth/RWZvR6wQQ92pN39:3TDxR+N5YzTBjM1b5+Pl6bJTIZ5jdgpX
TLSH
T1D055B02EA7F915E9D1BEC6799A23C502FA727821073193CB42A0C17E1E375D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 3366052e1bd3e8eeb93d0637350fa7871a62d12c0bc7a56e0f45db9d2cc3d32e
MD5 65fe13f49ccfdd1488d6db228836eb23
SHA1 c8ad9114f827a4dfb14d053d80413efc48269932
SHA512 b2a93274f87697667afaa94a2a0274582b88c4e9787f666471529e63d69e9cfe005693375f758921bfa4d7a086dc05c2cdb81664f7f56afcbfb3c6fb8fd4ab4e
SSDEEP 24576:X3YgnJcRTk4yti+R5dBR/smb57GBiOl6a8JTth/RWZvR6wQQ92pN31:XIgnaTk46pBR/7b5+Pl6bJTIZ5jdgp3
TLSH
T19445C02EF2B910B9C4AAD236854147B5FB71782D1F209ACB0170C538AF1AED85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 7de2e53aa07a5254ccdd790d4e3269f36250c18e9ea0201b9a6497f73d329b58
MD5 77c02b4e3e4f7edf0de561f6d35aab76
SHA1 b08d25aa47e031b0203903ef28e1f5cc83eaa601
SHA512 086dea5a5623c48e58d21496d9d8f2e612b965375cb83d63b4a6ea72b0e6ae0e14849270c557fdb3b3f149681097b8dc84c944ba250682e33ac2211a576f795f
SSDEEP 24576:temb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:tBb5+Pl6bJTIZ5jdgp9
TLSH
T10465124A07E930C5E0779339CAEA8701E570BD669B5627FF55F4C83B9B326C8A835702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-424-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-445-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-428-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-425-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-429-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-423-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-427-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-422-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-417-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-418-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-421-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-419-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-416-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-420-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-431-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-452-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-451-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-450-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-449-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-415-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-414-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-430-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-432-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-433-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-448-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-447-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-446-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-426-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-434-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-444-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-435-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-443-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-442-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-441-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-436-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-437-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-438-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-439-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1068-440-0x0000028EE4A90000-0x0000028EE4AA0000-memory.dmp

Download

memory/1088-485-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1088-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1288-75-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1288-81-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1288-196-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1440-194-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/1440-92-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1440-98-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1772-411-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1772-305-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1960-60-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1960-54-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1960-64-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1960-66-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2016-319-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2016-528-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2420-262-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2420-318-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2420-263-0x00000000005F0000-0x0000000000657000-memory.dmp

Download

memory/2420-268-0x00000000005F0000-0x0000000000657000-memory.dmp

Download

memory/2512-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2512-68-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2716-401-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2716-279-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2724-272-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2724-322-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3048-33-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3048-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3048-253-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3048-39-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3404-308-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3404-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3672-404-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3672-289-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3672-283-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3672-282-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3684-527-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3684-315-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4104-197-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4148-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4148-25-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4148-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4204-295-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4204-301-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4204-405-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4204-294-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4220-327-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4220-400-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4220-275-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4516-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4516-254-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4516-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4516-191-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4684-328-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4684-409-0x000000000CDF0000-0x000000000CDF8000-memory.dmp

Download

memory/4684-412-0x000000000D2F0000-0x000000000D2F8000-memory.dmp

Download

memory/4684-530-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4684-366-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4684-382-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4684-413-0x000000000D2F0000-0x000000000D2F8000-memory.dmp

Download

memory/4684-398-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4932-323-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4932-529-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4960-89-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/4960-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4960-0-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/4960-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4988-13-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4988-252-0x0000000140000000-0x000000014017D000-memory.dmp

Download