2c6bfd2c8ea88ed350d87a42521eabda685294ddcee29a8353fa67d008583d2e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
Size 2.1MB
Sample261011-pdmgcahe95
SHA256 2c6bfd2c8ea88ed350d87a42521eabda685294ddcee29a8353fa67d008583d2e
MD5 6947f412ba91ac1b9c09ca4e52fd3620
SHA1 c9fdf83fe9ccf61440e529d25fc37f4f82a19469
SHA512 641db026ac52cc58f3b1820d442426fe6ba7538a87f388be07246d122e725bad1879a89da3274e3369c602b4936b38e46e168c043934c53e4d00370626d75da2
SSDEEP 24576:RdY4jyB8iFTEIK5L1vpsvUrdp05K9or0Esv20MiyQErBGGZWAsM:RKSyBpFTN01vpbrjzGr0EiyZF8
TLSH
T18AA505377297D0D4C41D90B4CF160AF195A17CA9C7E59BDB01CCBE24BB326E07ABA609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1276	alg.exe
3220	DiagnosticsHub.StandardCollector.Service.exe
616	fxssvc.exe
2104	elevation_service.exe
4792	maintenanceservice.exe
4532	OSE.EXE
4568	elevation_service.exe
632	msdtc.exe
3884	PerceptionSimulationService.exe
2160	perfhost.exe
1052	locator.exe
4232	SensorDataService.exe
4692	snmptrap.exe
2312	spectrum.exe
436	ssh-agent.exe
428	TieringEngineService.exe
176	AgentService.exe
1348	vds.exe
3012	vssvc.exe
3656	wbengine.exe
4036	WmiApSrv.exe
3488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3db14dda250d612b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000127c67df7d59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000129a47e07d59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002016c2df7d59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3220	DiagnosticsHub.StandardCollector.Service.exe
3220	DiagnosticsHub.StandardCollector.Service.exe
3220	DiagnosticsHub.StandardCollector.Service.exe
3220	DiagnosticsHub.StandardCollector.Service.exe
3220	DiagnosticsHub.StandardCollector.Service.exe
3220	DiagnosticsHub.StandardCollector.Service.exe
3220	DiagnosticsHub.StandardCollector.Service.exe
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2972	2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	616	fxssvc.exe
Token: SeDebugPrivilege	3220	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2104	elevation_service.exe
Token: SeRestorePrivilege	428	TieringEngineService.exe
Token: SeManageVolumePrivilege	428	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	176	AgentService.exe
Token: SeBackupPrivilege	3012	vssvc.exe
Token: SeRestorePrivilege	3012	vssvc.exe
Token: SeAuditPrivilege	3012	vssvc.exe
Token: SeBackupPrivilege	3656	wbengine.exe
Token: SeRestorePrivilege	3656	wbengine.exe
Token: SeSecurityPrivilege	3656	wbengine.exe
Token: 33	3488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeDebugPrivilege	2104	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4552	3488	SearchIndexer.exe	137
PID 3488 wrote to memory of 460	3488	SearchIndexer.exe	138

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_6947f412ba91ac1b9c09ca4e52fd3620_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1276

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3176

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3884

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2160

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4232

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4692

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2312

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:436

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2936

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:176

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4036

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4552
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7731adf757fafbfea80eb6084958af7ccf834499e096f97173ca44e30b48588a
MD5 4ed8885c980538e708fddbe1c8e18193
SHA1 6ceaa69fc8df2ddac4dd8fbe19c7f41775fddf55
SHA512 e822912da03dff9e404eaa7fd534ae23fa5419a8b34c5c85ab4a720847f208b4bd4ae406c2a63c09b770b7769750a156c1b140833bd1ade665f8a57e7e82afb4
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxEiyZF8:R3q6HjBTZF8
TLSH
T1EED59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 75431583130669f7f443b90692779a5aa76879e9c9463950a74082f91c1ffc1b
MD5 7bc6c4fb05016267511e0c7ab94937cc
SHA1 8fcaf39d0aba6927945ba66f8f82661281540eff
SHA512 1bd4761a2522280eb44e3a5781b0c96092c333c0a8e88b1740608e26224d3b0e328e0e7728b8ea8fc907f8f6fb44269f16685c97712e4a7a32bb53fc06bf559b
SSDEEP 12288:o1XLsswWkxy2lRq2czAJ1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsm+:OXYfDtczA/Esv20MiyQErBGGZWAsD
TLSH
T14C05F128739408F9ED57813CCDB2C506EA33BC9547A0EA9B03E496295F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 68fd2219a5107cf23f214656db7cadcf89e2b45953f5d326d9f22402c9e66f8e
MD5 bfc8417232657cdff87f9b96812dd9cb
SHA1 9753d802f4148804174a287ab347e2fcab2ea6f8
SHA512 132d404a7a74794a7ef6b769ea5c78db8d2b2c7c5c125ff9e006fb0cbb33fc18a52b6f88d01dba4c3f0c927a2286395bb2f6a291a074d2b883f58333fe797cc9
SSDEEP 24576:v0Le5ji0hmxirMiEsv20MiyQErBGGZWAsm:vPji0ActEiyZF8
TLSH
T1D135AE15F6748735D073C0B9C5D2A68EED7230825B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e09fafe6ca834bb781d03cdb2d8bfd719bad852f1b46f3d1b94d29d60b98f008
MD5 b11cc8963b35c704e1bfaa0fa0b47fe1
SHA1 6870148656defae669b38be02b48bebedba776b0
SHA512 ad4ba47111779475e8c5489b6848dd1d34b3b9e8503d8667016fccd832cd62eec2344a8dc90c3043614a2e3ffae41ea25383e244f9a7b4de86a6dd97ad63e0ef
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuMEsv20MiyQErBGGZWAsc:R/ezSC6vUzPvxHjyJEiyZF8
TLSH
T101755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5e5543fa4aca134db0503234449272246bccd1af30a8069ecc9346fb9dac8864
MD5 1bac99e1747e7809b307c3921163f655
SHA1 347bbaf27cadd590a6ec01aa8674b8eabb994bb3
SHA512 e12469f745dad3cd4d43c6e4a929db21c41457232ed639472efe32f69fcaf5ead471137d6c2a45e374f7c6e5eed5cdc0fd916e1bb3f29fbe8423fb2ba7c9d371
SSDEEP 24576:nVbqPb88hv/l+6jEsv20MiyQErBGGZWAsz:nVO88hXl+uEiyZF8
TLSH
T1C4559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 bb61948f30f4b5900542edc7ae504a4e2a987a2049e487335bc97bb47864e92c
MD5 afb55ea5b652fdafd10b3e379295258d
SHA1 503967e0b528e1e16fab252943b847c6174b45e4
SHA512 86410bcc332f805404dd6039121be22c80f978281d0a5f11e2893c276f221dd5d9651003ddbcce74b6f245065efc5a1810ccf8207e24d0248b89f0ae06015e17
SSDEEP 12288:6Ra1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmv:6R2Esv20MiyQErBGGZWAsm
TLSH
T1A4C4238052181C6BFF036D345DF6E8CFDA329EE5ACB50C61AAA1F31D8D3D422EA1D425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5f16809b727c7c2a2a6e45b57d8e0a64465aef444e6c202ded0cca1a17844375
MD5 f1c21ce30e58ddbac0faa5a041c68e4a
SHA1 c74f0512d64f522fa4f7c25933ed4b67e0907d08
SHA512 e3235b3a03ac0485607c0e84c5d7d7e6564e1ae6b601fc466a41efaaf0c2267696749f182d5ec6b0e6c2bc8bcd4542af1128ab55b14b078316f1ef4198ab7e23
SSDEEP 12288:4eBNUbTVO86U11V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmv:4JIU7Esv20MiyQErBGGZWAsO
TLSH
T14D05CF3BAE28FCE2C67A8D785A918640D77278704F6293CBD165C30ECE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2b3fe22c6ab09ba058583f4eed61f416b8ff1d14a69968ae0ee43a33b4393965
MD5 2f12a077f41c37873d8461fc65e626ec
SHA1 b1c6a143003487b24e1dbd27b05b5027cfe5f98d
SHA512 8d5d7577884f42227d55d538f997eb8537cdbfa30d6d313903ee77324979f732daefa8e0b278c31c61da7353f1b97fa8094862343a2942ef635ba74a960d45c0
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:IQvGAdlCEL8c/yRNw5CLZF8
TLSH
T1A0267D656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 434b2ac46bb74cd9ad35c5b5af27c02190164d4cb246ad41b9979b9f02d948ba
MD5 ff5e8dc0af091b97ec09dd5420934fb7
SHA1 03ecd2ee7f1ca270c351e7291ab63349c8537a3c
SHA512 b1cd0f989d1b6e70cfc85cc474fb82828bcfc4586070a0d565910ef35efa376233978090a952596d7dc356d0b5e23cdda6766d57e1a6b69ddfc72d83ff7580ed
SSDEEP 12288:xAwSfxL/2Dc34DLLmt0LDQewsAjf1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAY:SdewsAjdEsv20MiyQErBGGZWAsz
TLSH
T1C215E030FA74E436C77B0DB11B36C706583DBA604F6119C3E3E89A9E59341D2673AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2c3882d8b77de7a6322acc393fe37f011af0fd6a7b86ee837fbd5cc6161716af
MD5 5fb9e697eeeb8a7f16cca4cf7cb6b684
SHA1 c1cec4dfbfca308a3a765a11a6df78995625b741
SHA512 10717dd4a71eacf330569759518369eb6bdc7a0984cdec41be9aa54702af8e51a987d1c1cfbfc9786762997f325ad0bcbebed1d761924a2a5b98d22d9d7c57a8
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHS:oUEtQevvqc2W1cpV2EI32S
TLSH
T1D1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 69f253b881f16c2857f9c3a14947c046529c8d0a19ff4938ab1b140b9e79192e
MD5 693a523952c2d17c24eec792cac711df
SHA1 7d01efe47c21696c304d0e7a7d122264912cbea5
SHA512 399aef07b6689fb1d5128fc9886048663bba6df103ffc54159b6c5a963e63b7b11c9b6e7c4727300dffd7badda7d2abf76e7882f289608e2bfaf68d4a7f2ddff
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/z9EiyZF8:boqtVjnmPZF8
TLSH
T118D58E0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f57d41a16a8658272ca05ca8bc991545899ac1d6dc005910bfa052768f5c9aaf
MD5 d840aaf444de7a56858f39174b2f61d1
SHA1 9a421c0196b34d05c30426e92068beee3c4e2b1e
SHA512 90449a970609f7d0deef38e455dc20e737991a6a5d7daafdbbfc252a1fd8ae676480f724c56791f79c60a5b9c3de924ea96803b1f709f4b3d01dfe6ef7493d04
SSDEEP 24576:4AhGLJIFoiwtA5l7S53oEsv20MiyQErBGGZWAsA:4AMyFoiq54EiyZF8
TLSH
T19D35AD80E7F945D4F5B3AA7899B69171EA76BCA65E31C20F2160D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b6715ceb81c572a28465813878a39e169168cf951e2111e09109f784a6fa6e5d
MD5 adcc150dab584998698a88351e220688
SHA1 f6a0fef5e56b46d264c92ff8c3de4faa356842c1
SHA512 bfd0765f9291da330641b4c5f4ac5011093100b7f7e166e33b0bf9e19458490e05e040932c9124f587c66c9923cb8ed4e25a8b892d62d2321576086ffab03d48
SSDEEP 12288:0mw5HEjsChNVBFgl0WDm+Cw1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmd:xwuoOWpEsv20MiyQErBGGZWAsQ
TLSH
T1A405F14572A80CF9E963953885A7C536F7B2BC512A31CB1F17A0C75B5F37221AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b99e0869ba1b2c08a4dd407d8d5f5f4182b41e765cf04edfe86074f942836b03
MD5 004ca60388824cb6c73c55ca140f0b89
SHA1 2dd5b5cfa8cbd59be407acd9b1fc2a51cada0b95
SHA512 b11e95012e8863826f174443b5aa457ae32198ddd36f15a35f966adaf273f9074fb7dd956566352b70a18311b6e09cc5ff17ecc8d4a64481a44b69e4084df89d
SSDEEP 12288:5BZ1Iyv1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsm0:XZuaEsv20MiyQErBGGZWAsZ
TLSH
T1E8E41284329820FAE643553C8CF19A8AD7727CA2677207CF1661935A1F379D2AE3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8657ba967448b139a6da8232bd315aa72584ee795d307a4dc9b6d75c063a5d7b
MD5 14a09ad32a1617d239bb4f48bf4e9b2c
SHA1 b777f0ab38d61447ce6d87ad3aea1f32bf35acbc
SHA512 7cbc2ebc0bafb51cc127b9582aa11be06a7486a23480fb3b0df8a13cfee81293d7e5ad74bcceb1c5c262846a771963a473bb7c02ea452d930137d0143ee0cb49
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:dQRQyi36YOcPQLvw2gAf+PN36ZF8
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bb634037a21ac615e1bc4daf0acb36e01a326e57d4785298ea02839cbd6152bb
MD5 69631ee7cce30b88a8e13a021cfdcb46
SHA1 1d22e05e98e2b16718e8b7866d974cebf461ccf0
SHA512 3d7c17c7c89a129bead0596606a165e5e16a6a06a66136b06d8f4ed4ae854a9a8c209c36ee7c3f97f81d1176994e7b76f1b47d992f479192c982c14bf8d61fa9
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:FQRQyi36YOcPQLvw2gAf+PN36ZF8
TLSH
T193667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dca7459d8fdec262b7c7e7fe84b7156c2b922f35e851a04edda193598fc1b365
MD5 7a1cd1c6337c8b8106ef000c10cd63c6
SHA1 bc2a22455449db7230e86aeb22886aadd19ed390
SHA512 d8f759600ed7b6cd82926f1642d580d84eef4dd203091eeafb6916024933b897dbea82825b285bf0ec96f810057c0700ce6f701dde837b0aa0a5c83d81c1760c
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0qEsv20MiyQErBGa:Q68Qg55nhheWu7PNU3/tEiyZF8
TLSH
T13AB55A33B2F600A9C44DE1769F46872196D27C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a366441e1d7b497da2d7147bb2df61e67fe77079965ea40af91c27cbb6170ff9
MD5 69554ad71e49b9951c92b0d4fddf4213
SHA1 0592470a4b47b9bd5c3144f4ed5e4b2b5b69ff95
SHA512 fd380cf2a36314238861e2aec73672858a4acaa00c0c43427e4ff96d9dae3b08cb5c1eba0acfb8ba2bccdfd5548a3ae5dc02198bd41f6710ad5f996bc27411b1
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:dy5112gYy5azzVvL69nLKnhZZZF8
TLSH
T1F9167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6c438f22423a6c26eddf68a77970610f67a66582a3ef715c3c234387f654fbb7
MD5 71a5e3f77a531f480d27ed82f4f7efbd
SHA1 c53b51d5b6fd11796701dd7f1bc84c5c216f4b6c
SHA512 f12b66601746c10a917e49016d0a3b85c8edf930e4b97e945df3fe46e182272e2c25ca19292f283862a5af1ebae56b8c0f719e03879388ea96cda229df2105c2
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glEEiyZF8:eu6JmVxd2dDZF8
TLSH
T127D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e6a53e13bdb4f7298fa7193d4e49e01920bcd27b8f0cf669208028de4331deb2
MD5 cfd09bfbceccbead13a76c08f436e887
SHA1 3e5f66526b18e0234cb570acb08580d1af4001f7
SHA512 9a9537d1c5ed768947695323079cf312c74c40c9af1446043f99e97bc91690f10b0c1441cfa7f5215e6f651a699595a45c2c5e44cba85024fc5295bd4d6b405a
SSDEEP 24576:khv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3LEsv20MiyQErBGh:I1hpsNoJpF1A6UU44CwH7R4xbEiyZF8
TLSH
T189B5BE13F2D900E8D05ED17887569632EA72BC460B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7fca74b7d73ae0a258b1c0c8530a21eee8f9e59b5578567eedfbb8d251e213f4
MD5 57bd0fb794b96c0566b130d06034317e
SHA1 2b7c5e055e32c2522e094ba3855272c72d69f134
SHA512 d864f86343c940804e4dd548b3e3f4fd60dc655fc6a478fb32d761107f2d25371487bc926fff78fb8fa8a54c1dcd676449e0d424cf1580ed37554235d152f1d1
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqaEiyZF8:f5dKTi611ZF8
TLSH
T1FBC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4a6459cfd71265e2ada11e566e8213ccd4b889a81200f1dd911e7c1d5d1a3c7a
MD5 a7190c1c2639b2fbccd4dece427e06bb
SHA1 f8b8bc38bf778498b992a77125679b4dcc1d0a41
SHA512 b7d0f14f47627b03a404d8d9f81076f8b0c08d835e0aa2306ee352d1ecfa9d7380679572f42ceceff41fab4981e8309712416364bfb28d57f68f5def85e1239e
SSDEEP 24576:VhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLLEsv20MiyQErBGGZWAB:VhtSn8EApI0figngiDn0AP5w/EiyZF8
TLSH
T13D95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 fff35b8db5368c00cb43ae5eef0dc0fb387557dd21f9394512fc9ef163a1b5b5
MD5 39346a1302e5cdb37fd5f770acb628ac
SHA1 34b246ce72694d0320f82219b33ab6c8afa6972f
SHA512 82894f0d13c286b11ef65ec5514cd046c532d103d15dfbd73ec7f6ea072237446c589df9d0bbfe52238752c4c4780188660769a7fdddebecd15a3b4a810fbc4a
SSDEEP 12288:Ti1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmG:TuEsv20MiyQErBGGZWAsz
TLSH
T128C4234061184C6FFE039D344DF2A5CED9265EEABCB60C65B792F31D9E39432AA1D834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d019a3dece3951cf20894df5258d5f2eb7c61fd620051d9cfa90d6f4ac51d634
MD5 b7fd93b775c7773fb3d52dbbd8e328ba
SHA1 2645fb050968700d09705f48186742ccecf97159
SHA512 1507a498328e9aced31d4775e58e307e200f5bba850831af95d650a4a04bf48c5ea1edaecfe2177198e81ecfea288992e130300c30d792bed231a78a6e33f2a7
SSDEEP 12288:nD1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmG:nxEsv20MiyQErBGGZWAsz
TLSH
T1ABC4234061190C6FFE039D344DF2A5CED9265EEABC760C66B792F31D9E39432AA1D834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 382b5b6b1bcef355009096398ee5fa9bc9d7d0a6722e42b982c3f6372763a2e1
MD5 d81ef6895ab90986e3474876e6b372b2
SHA1 a923ed33c1a9a9741fb80835b020b49ed38ddad2
SHA512 4fbe64e4633904be4dc316e185edd8ab1d01fc4f0c2518154e7b6a520770e2360dd173c7d04067df8dc77eb722e4aeb31fe7912c9a92c9d20acf1095bfb9cc7f
SSDEEP 12288:w91V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmG:wzEsv20MiyQErBGGZWAsz
TLSH
T14FC4234061194C6FFD039D344DF2A5CED9325EEABCB60C65B792F21D9E39432AA1D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 2ff27965a6b2876ceca449218a96b1d974865c92a1bd50e530c36d19ab29b63b
MD5 404619175bbc6b73b3a62a72a1f055a2
SHA1 1c0a5ca68b749e23bbd5cc3825ce11854326486f
SHA512 3c4ad8ba904b7c37e7de16bdf2da1e8e46622ee116ce48cbbcc1473aff5d35d1616a9859da40a51ac6b97cf671bb430348504848e65b68ba6a59ef852e73156b
SSDEEP 12288:fVs1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsm4:2Esv20MiyQErBGGZWAsx
TLSH
T134D42340221808EBFD03D934CDF2D5CAE672BDE5BD7619AFA751620D4E35261AE3CA34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2e161227cb341e4dea6fb352a5b5e69a3c6628777dfddeaf445734e3fb8d1981
MD5 f6a0b8511eff49aac4ed69e9d6122c39
SHA1 61a66155e20542ef9b8c0069f35a5930351a7816
SHA512 39f335d61b560c634827aae1420c7726d16aceccfc18af165bfc90c733e9a5e5dc901cd4b7dff92b391c55fe44e7af3e870f1c4881cc4565eca18ca8b6642446
SSDEEP 12288:rk1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmr:rQEsv20MiyQErBGGZWAsO
TLSH
T1C6C4234061184C6FFE039D344DF2A5CED9265EEABCB60866B792F31D9E39432AA1D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 677ea3f3c24cb22eefe4af4a89d12541704e74b689ae07022546bd608f8c0944
MD5 f05ae6e9d8ce2955aacb7e106efff6a4
SHA1 279f326b5f9f7706eb3504eb6d64cfdb4bb22417
SHA512 b23d3a2ae36b3cc302b140b8681a20f572eb6df89b4463e6407fe82ed53c5437cb7a1c4b90a26ecbbaa00f00be8f019954d2b82ef3dfbe7f0ec19ee55777fc1b
SSDEEP 12288:en1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmp:e1Esv20MiyQErBGGZWAsw
TLSH
T1E5C4234061184C6FFE039D344DF2A5CED9265FEABC760866B792F31D9E39432AA1D834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7efb4a98542b05bebda394049381e7a29d2f0bd99b0dc0176b34dec8a59b6d36
MD5 a2eb6e48bdbba602105e3a05b9508cf5
SHA1 1670f2afaba9c19b5b630525c1836c2fda51e1a8
SHA512 1b68dfb8afc1cbf2e9ac0ee9451f5aa23a00a616ed72b4eb160b7a3ebb7915230249200e8d14b8dc2e0c6056be105f44631e23ae09b630160d8bfc0a066c1b62
SSDEEP 12288:7b1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmB:75Esv20MiyQErBGGZWAs4
TLSH
T185C4234061190C6FFE039D344DF1A5CED9265FEABCB60866B792F31D9E39432AA1D834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 892edb12933bd4ba68cfccd68f596e1d1f4e63828f22cdce2c3b4a805831bdd3
MD5 789f44a0f3ef9e7755daa3230d564bb1
SHA1 8fa700f6c2785ea1417ca86ab0a1d6f7dc85cd40
SHA512 9108515568b8cfa6988f99f8270bbd56bb10576afb737dce55f0aca593391e826eb590a662d70b1bcf63ab9a1e07783c105a044143fe1bccc624879e08add2d3
SSDEEP 12288:5iZwb6zzFEoS2cPvyj1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmc:8ZMSzFVSOREsv20MiyQErBGGZWAsp
TLSH
T11D050194B3500CF9EC63853DCD619946D6B2BC6A1A70CA1F13E4322A5F333A15D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d9faf57f0e55ad355c6bc39cd40b002b31811ac0d6d81ab9517c255d5f1206ce
MD5 31b0ae35a36e82e9745fb7108f813dc1
SHA1 55e9580f2040d4e97cf019f95c62a64ec4521d7b
SHA512 c8a3c6c18613e5ff4bda980673d4c86cc37e5f0bd2f79e011c22b42467d1f8f5c471da869712643c219c24b5eea2c2be600383f8014a8ea5188d35255a58918a
SSDEEP 12288:Lu1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmW:LKEsv20MiyQErBGGZWAsn
TLSH
T126C4234061180C6FFE035D344DF2A5CED9265EEABCB60C66BB92F31D9E39432AA1D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5a4390ed893ce914649068cc6bdf0bf0290ab2d0bfbe9ae4daedf2690692ba07
MD5 19a26a56df1acb691361948bff7a6603
SHA1 e5de0acbbd5876d0e9516d4f2b24688082555c9d
SHA512 362ca7834e52f5283dc18cfcf33f342e6fa247e6b9c00507d15508bb06cf0a11f09a93e71944692256da4f67c1e46b0dea75bed28d9ce5ca785c137ef89865bc
SSDEEP 12288:4q1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsm9:4mEsv20MiyQErBGGZWAsE
TLSH
T138C4234061180C6FFE035D344DF2A5CED9269FEABC761866B792F31D9E39432AA1D834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a6405138d7944e8ef9a725a9b28701c061236c79369c04aa6b776ed83f117682
MD5 780cd57f137c8507c728f6e0bd13e3b4
SHA1 47ef1dd24187ac75197e9b67221b542291b5df86
SHA512 9ee2f11b629ef48656249c42627f5d7b6f78cb9ff2f0d91206c4fdeaccd87011cceff6d446b5f5c06c29be0b9319981f38b3510d04cfe13ac1df8f2f882415a0
SSDEEP 12288:UyPz5L8v1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmT:NzyNEsv20MiyQErBGGZWAsW
TLSH
T15EF41242736520FDE513923888A25946F772BC765B304DAF17A0533A1F376A19E3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 152601c8cc6893b89a6b5bed23368545325670915a41b7a90957b1eb501c4d06
MD5 4b541c4f08824994fb2f3c43d872763f
SHA1 ee684f7e2e0aec83cdbe0d1b6e5fbe0d188ba448
SHA512 130a2eadf5845eb6779d0fd91015d330ec8df81091475af6f481fb1ba2155fb24d4acfd4749fb48c16df09623a85f5805a520992e369d82e47144019c42b517d
SSDEEP 12288:Fu1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmO:FKEsv20MiyQErBGGZWAsn
TLSH
T14BC4234061180C6FFE035D344DF2A5CED9265EEABCB60C65BB92F31D9E39432AA1D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 bdbecaa5e27ae7312790cc66af2ff51d644960fa4488bdd9f6484666e3d2f1da
MD5 3bb63b2712d0539ac634598b2464e8e3
SHA1 daf4a2585722239dd644bd821192502024a51683
SHA512 d194cb1acf1f1120edc4c7da6eb293e1b0a548da1b8e5c5cc188f3e8247cf4f5976bdd6ee2cba2d822590301abf26a8c985175888f7059e8531bea71aaf83878
SSDEEP 12288:/u1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmO:/KEsv20MiyQErBGGZWAsn
TLSH
T1A3C4234061180C6FFE035D344DF2A5CED9265EEABCB61C65BB92F31D9E39432AA1D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1ff8d17bf068b222bf2f555e55797660817e2ddc977cb975f24ce50470984aff
MD5 a41e5acbcaa085fe57834f3360a38c7d
SHA1 f3a596e9c20df113ea6d9d1c1b18c739c4ecf6c9
SHA512 110bdbde4b10bc16b6937c2b0019a890ebdb3088866e46cc939c764f803b116baeadd7156c5db957b12087897f089d9a0597028b8a3e8db2a9a667a0578d852d
SSDEEP 12288:uyPz5L8v1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmK:zzyNEsv20MiyQErBGGZWAsX
TLSH
T15BF41242736520FDE513923888A25946F772BC765B304DAF57A0533A1F376A19E3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c70bb2e446d41f2398da6dbd1973ab50841d853ec6296f8f3331628611422c36
MD5 163d8f45bb92bcd11f6c2eaf0408150a
SHA1 1ebae23030db754776b2a8ef1c3b3062735af8a7
SHA512 11ab897e07f77a5a106327efb77c93d01169b6f9b12c8cdffbf39e4e3573caf75734a6209ffd206ca641d654ddc5ab82bf6cf8e9a3074fabfd609b5d1df65b37
SSDEEP 12288:zCd9eWYoaLHF3z0z04PDvht1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmS:+THaLl3z0zDDEsv20MiyQErBGGZWAs/
TLSH
T100050194B3501CF9EC63853DCD628946D6B27C6A0B70CA1F13E4362A5F333A15D2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c17c6e70760053e6274902fdf818e554180a45282a46a2d86b2aef060770c747
MD5 7f1d79607502c89583f05e95d58197bb
SHA1 cd53fd873f5faaf8dee03f9f4567f89541b39e59
SHA512 11212266c9a3ab2a447e701b643c6fc31a28c09337fb11ef3d20f2f6abd4d4cab180524797cf5d90964a23722536db8617d8193513f7b29c3cb3599c59293829
SSDEEP 24576:a37d9CHKy7GZXEsv20MiyQErBGGZWAsn:87d9CHKyalEiyZF8
TLSH
T1BC25CF90F3E414E9F1B39A358D769502DA767C9A1B31CE8F03A4661A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 4a0428ac56374eb5f99902ae867f8198ecc2ca2a28f259c5599ae5f866745c22
MD5 908ef68e4f0531d9f1bd8b98e721dc36
SHA1 ee5228e4c768999decedafc64828c243796d4704
SHA512 288fdb5527f6a284c6a6705a83eaa4c7d4332df91a310e5c0f2cef665a8e4cece7020c15341ade91a983663aa125ad8adfabd428f861cafea91df345ea97199a
SSDEEP 12288:ed1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmL:eTEsv20MiyQErBGGZWAs+
TLSH
T152C4234061184C6FFE039D344DF2A5CED9265EEABCB60C66B792F31D9E39432AA1D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 3d92344eb19a80eee219fde5e01d6e91db9e9391d9f5fd7a7be1f9514d21798e
MD5 51a6a613fd65007ddb04d10d4caf3029
SHA1 231e2dfd6a09903b5d282b0e3e49c31169d6fafd
SHA512 a9665284b172e8d7d2191ea0a85b860e5627a776dca59de7c49b67980e4cd862eabbef95e2bbd890203321faf24008521825736e724cdce6ee2894e752ee3971
SSDEEP 12288:KP1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmj:KtEsv20MiyQErBGGZWAs2
TLSH
T188C4234061184C7FFE039D344DF2A5CED9265EEABCB60C65BBD2F21D9E39422AA1D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 1c7df564ea287cb3903148d19ae81c3d216cb12d7fa1d4092d81bd387693e15b
MD5 8571997571e2163bc5f42be468bf0c01
SHA1 9e56e18240252ff6be71fac49e90e2a5581ad80c
SHA512 7043a3a12eace35d6926af47ffee1cc1ee48157541ac78b5cb24fecd099f29ff65a028ea67c56eb7d7e6d304d6a07636d09482202fc351cb68add38176518b36
SSDEEP 12288:XI1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmn:X0Esv20MiyQErBGGZWAsa
TLSH
T179C4234061190C6FFE039D344DF2A5CED9265EEABCB60C66B792F31D9E39432AA1D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0567f9d7c1943450fd5d9ded41e12c78769268e7aa3c469abd95737684c9c2c4
MD5 0f449d02b66505f42bfe000bf41dc5c2
SHA1 d5380efa1489db584afbfd52ec4049c674726623
SHA512 ae7a52efe79d55b0f0ce8fb7330037aafcae955c5a33ae449a7dd956941c30a2553b91be7cdf22afaab6ef7d93ae24e6df246d4884b0ce87ad54a287e164e3ad
SSDEEP 12288:7Nsfe1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsme:4aEsv20MiyQErBGGZWAsv
TLSH
T151E4F108D25801E9D41E6538CBA29A85F3337C6597F196CB67D0F23E0F3A5909EEDA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 68963abf9053411f1dd18dbf461694702db6d49f263161bb614f3ea9483fd1b0
MD5 4cf9ec232f8c29ba9dc8e8b4ccda99b8
SHA1 f8ed843437cddfeb03b3439b84ee7d959b514ba6
SHA512 eaa71aa1c3431b125f40e3729421fcc0e79d9027ccc3b9fab0d31b590de3873c67eb1627639834439404f7a1d657b0eade298c253f010ef79480575b6c42c91d
SSDEEP 12288:7z1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmN:7BEsv20MiyQErBGGZWAss
TLSH
T148D42340921C4C2FFD03AD3049F2E48AE527AFF9AD750C97B681B31D5D39462EE2D925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 655ec14f9b71e0f8dedc041b08ea723bbd274a5a71aff575ac759a3df995f196
MD5 5d83f56f845d14df991c3aadb0427776
SHA1 d44fc489db3f3ad45a88de086b64e2cb5fc151d9
SHA512 4172d37cf4a5f8c9c4e835a97fe8e08e4c87af554ca75b8601ca450078113fd7bb7833dfb20818c62a48619e8f58e22f9c8eb56ff23cf66b3b789cc5ef291231
SSDEEP 24576:ooiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/bLEsv2f:oa0h2GEkuAe73q3pp46zwwQPEiyZF8
TLSH
T10F85AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 8e5e6ec04aa99f2ea222fb9561ef226fadbd4c54a45f9b3df6050c2c1afd166b
MD5 14d91e280773954cf30f35268ea2ef5c
SHA1 f6f503b728ac5bceab244b0020416cc5d284e2ad
SHA512 f877293058c2c1095b1534a3124280d67ad21b43f1b38061c9faf5557ac4a842f7ece3b043ec791d05fde8af055b00f3d355deb43eb0411f26353f42387a28a6
SSDEEP 12288:+hbHjfXu1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmf:+hbHjPKEsv20MiyQErBGGZWAsy
TLSH
T132E4126C22AC1499F922E53C89A2854AD331BC652B2157EF23D2923E4F3BDE05D3DF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7eaa04d4729633512756c48c951401c7194a79a8989a3459f320397dc74ef383
MD5 a18b5be32cae08dd1a422471adcffc0f
SHA1 6bc8e7a1f8f8fda914ae303fadf1b44b0a174953
SHA512 bffd5d60b024051479f8df6a1d603349fc851b16e1d5fea413373777f51d9fdef2fa7f337bbb2a74caf5319fb1e2190b4b6348e11f3b54031fb5fc5efef1c904
SSDEEP 24576:C3YgnJcRTk4yti+R5dBR/iEsv20MiyQErBGGZWAsR:CIgnaTk46pBR/iEiyZF8
TLSH
T12445BF2DF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C638AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 efc87fd0e281ee0a71988e2cd201770d6ce6bc2ae33ef1344eaf71aca3d3934a
MD5 f1c9082228bbe95af22d3d84b2850f62
SHA1 3695cfa5e59e15323c48f0e36366641f56787e6f
SHA512 8f3381eb66b259043ba005d78e330328472db2f1109d9bffff30ce4ecdbe33f2c349297b3253542d8e2976ea4b9746f797679d4b06f40daae0116b53ab6ddb6d
SSDEEP 12288:af1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmb:adEsv20MiyQErBGGZWAs6
TLSH
T172C4238051184C6FFE03AD3449F2A5CED5225FE56F760CE3B592F31D9A3A4B2AA3D424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 5f8c5207b7ec273f1d36108ba0cf93c1962dbe20439886c7d2e428ee96beb904
MD5 54891750219cc445b9111c9a7f1023fd
SHA1 b2068ab6493301205f969b6051db45868f910f7a
SHA512 aea4693efc984c8652332dcd6dfeaa2a080eaccb72fbebb2044c1bfa32456d3223115f892a122caa2657ba5b6e9ae497e0f569e974a74d7398a98091e31c9f20
SSDEEP 12288:cOb9A4LWOsvAYFTE1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsm3:BpL3UTwEsv20MiyQErBGGZWAsm
TLSH
T13325F144F79404F9ED27D13CC9B29916D272B89D1764E6DF03A88B591F236E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 519c158bd1014357f2f169ed7b40a0d27f9366926ba5932d997eb80746f7a615
MD5 3de37be601be779900a2a990f7544c64
SHA1 31667035dff3f8691973c892023c9b423d8a78d2
SHA512 aeaf08142e3f5620c9e4eec907c4162a66476f327137f78fcf5d269b72420f4f47758e7d1a532c97f6c8167c6072cba716f52a6ae4988b5468e800a2c71bb248
SSDEEP 12288:RpFtpOg1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsms:hO8Esv20MiyQErBGGZWAsR
TLSH
T1DCE40218329C14E9E526A53C89A2924DD372BCA51B3217EF06D0C17E5F77EF4AC3DA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2284c781c2549db4d9f85ea5a60f634d41941e994e1865ebe6f7a35a7d9e16bd
MD5 0cda90f95d3e4239bb0ca852682bd47c
SHA1 04818332576d77159dba34767223230e0b6e9a0b
SHA512 bdb8d4253376862c25a75a9c73487eb15ae56b7dfbf237646aeb13c469433204aa84fd372d5be32322cb4ea98d7b2896d3d7c706f1c97a06316cb53ea56717ae
SSDEEP 24576:w7NM9YqZqmWMUkPjZM48Mv6bEhsREsv20MiyQErBGGZWAsM:w7cBWMpPjN8DbEhyEiyZF8
TLSH
T10565AE2D6BAC81E5D477D13DC9E28246F6B2B4611B318ACB1152833E6F37AF44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 75ec957ade6853b3c0b44f7b0f22d2ad48ab82da730c68c3ec69d0dd53c9229e
MD5 6db9e73d68f685fbb6144ce816c5cfc5
SHA1 105b95ed5121c01a88a443691cedcfd2b2e44dc4
SHA512 a7058e6da42d3b5876dbdb706b52309cb59f1d455d811a369fbb90a1302e8c3a7e8b22e04aa580be5696c996b5ad1e9a1877bb0f8c1cc737007418a5396c96e4
SSDEEP 24576:7W6BApg2YuyuNDYTabvcdvNYf8km1zEsv20MiyQErBGGZWAs2:7F2YuHNETovAvNYf8kmxEiyZF8
TLSH
T135857D6927ED80A4E0BBD27D45B6D286FAB2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 fe24cb5a407c5c85c53e5f027ccea3521ae0d2a1fbb0921f07e94f261947f977
MD5 467ec00b00a50c586e43b3335117bf9d
SHA1 fbae3e53e16e34b42ce7b555516ddf68cb8d9ad0
SHA512 58526434b10402823c8ea365239cc7af61e73149e5c031c8d9c25b09c5b3daf5f8c8b30d6ebe923c91681debd7147551df35bb92a141bb02dde3b68c1531b640
SSDEEP 24576:sAFs06+Omlf3NXEbToIEsv20MiyQErBGGZWAsW:BFs060lVXuvEiyZF8
TLSH
T11B65AF2F62AC00D5E07ED17D8997C91AF6B1746307255ACB0260C63E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b9091471c9d2aabc5098b088d93e151019aaa49272f1f8dc7d920888fe7011f4
MD5 d4cbbfcbb372bbb1241cf917d92461aa
SHA1 8c2223db1ed3ba5ae0c32ecc54ae6f66dba99d48
SHA512 3b3a39501e35903d7a13f457098be3a8914d43621b2573c94feeb4ec3a27debaa489a0635a8a53c4a570e199bb371dba3c80af1da90ee666e8e79ac1f0e56b51
SSDEEP 12288:ICJnJ5D3VkrDzxD1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmr:9JnJ5D3WXvEsv20MiyQErBGGZWAsW
TLSH
T1A015D02CD2A810E8E477C274819A5786FE72387D2F2269C728B4D5357F12EE09A7DF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4ea21058c059720bbb97e7b17a27dd00e2dc10fdc04f5e1d0f2caab27d7afd2e
MD5 a17bd54a288a5f24d4afaf78bcd38e9f
SHA1 e6b78c616d043680b5789c0934b7d25673aa3bae
SHA512 b4a374212e2a2905e3ac7958d52fdced183c4b517803f7a7b525501dd0d1c6756230d383c958a37563a454f8358e4d147cad857e07a06975866254434dc6cda4
SSDEEP 24576:SEPghm6/7IIXdwcXrif7qQncjlP65i3VuaEsv20MiyQErBGGZWAsE:lg06DIKdwc+eQnSt65aVVEiyZF8
TLSH
T1CB956C15B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 d818be8a97a7a075eba10b32ced8064cfbdf1549baf43749db0fb9e7e56085cf
MD5 3bdd1af8f11346e810c1739712655164
SHA1 9c9d8d928975cf1774bd1cff1544d39171887f1b
SHA512 c4149b76e91a8de15d90462be4b3f0e51d0086e65d5e93e9a67ebd68f066b9abb84236c660175f96902a442c1ad9501ea1bb9242597aba8de89eae72dea4ce4e
SSDEEP 12288:mEP3Rnx1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmX:lnXEsv20MiyQErBGGZWAsK
TLSH
T1B1E4125C235C60EAE517A03C85E18589D372F8B42B622BEF56D1D23E4E379F56E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 c7a4bc7194ab4a1ff45e9504ee2fed9fb875c1553365ca5bddc9558c29cfa7f2
MD5 39b27ab9d6530ff8ce2fa83512ffcce2
SHA1 b14e4773d278b690ab505312fff91e99165b42d1
SHA512 24cb58ab5ceafba5bbcb0795b1a5dc5961803043a90e6802fe96b48098a1dcea6edf560a9a27428fd385eae87ffe58ac1a78f34ce18f9328098ececf90b53086
SSDEEP 12288:Ljky21V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsm2:LIyCEsv20MiyQErBGGZWAsH
TLSH
T18BF4120463985499FA675A3889B381C5DA31BC706F3116EF61D0F33E5F36AE1AD38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 e0171853803636cc47b236cc4e052327f463b75a9376e53e4ec821d928db4102
MD5 96c215f30faf3e59e8cc521a0366a2c0
SHA1 94df3d9013e2c9759003804f1eef7431630e81bd
SHA512 8fb9d6d35c9362f13540db485f27da5ae1fe71d6e7aa973c4c616b0847018807cdee1553248914e57d4d2dd5184c79b183cfe1b8dfff7ff9e01095475944fb12
SSDEEP 12288:Syw1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmy:bsEsv20MiyQErBGGZWAsz
TLSH
T1FAD423442218186EFD03993449B2A9CAD5327EB57F751CFB65D1F33D8E3A4A2AA3DC10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2444ff3107023e44c647a00cf6df6026c292191fd1cd8e5737d7df6c19527c9b
MD5 23c6ab04c7d414ce124bb54e0fec6d9f
SHA1 454d048b93ed5d5f7c31c77aa6057c479e9ce2eb
SHA512 9ed052946386a4116520ec36bf131f61f2838c64361418aac84146fde75351ce8cccbe0db833ff83545d2c3a5d76d1ee3613e08a8108e5c884664cb1841b0090
SSDEEP 24576:9Q9MxZKdcz9dw3JEsv20MiyQErBGGZWAsm:9VKZJEiyZF8
TLSH
T131557D2DABE9059AE173D23595A250C3A633B4311B31D6CF2448D13D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 36c13f65f61433b771ce358611ed15ec9deca5793e78bc196eb747bdb22679f7
MD5 48145113de09f9daae921ee59c2ea632
SHA1 1e728a86312914d20dfd7f78ef9c6beac8916baf
SHA512 ae32c25a2e626cf75aaa5e0c34d8c6ec2fc9ff4512973b6a09984fb0db32b92880e101cefab6886ae0b8c8b758fa440227506e3dde27d6ca7853068fcd203110
SSDEEP 12288:cyoKo2JRple9pC1V+tutGq2JOjMYHyQE4SmGTGGqY+1bqViBAsmT:cyocDApOEsv20MiyQErBGGZWAs+
TLSH
T1F2F4E01FB76D40A2E123813C89918789E773B4706B6217DB6691C33D8F279E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d2c2633348570a8fbbd30f30357e2185ef2b63c1ff2be49aa5aa9528947036c2
MD5 3bb1939bece50b99fd8c8933d99fe337
SHA1 b8582c27132ed35e23fe526b447340701419308c
SHA512 c1e945014f6a296b8553ec9b5af91b011421826d98a3e15482631bb7e6940e6bf5b9aa55cb06b4f66dee902cb1c3a287c3e21a3a784a35cd323da62bb515932f
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKOEiyZF8:h0zuNIHZF8
TLSH
T195A57B3DA2BC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a444129be497c74f8054c5f1b137f2e17a105ce46cd573fba4cfdeb112d9411a
MD5 2e32ea5694968bb4ebf362bf471e7a3a
SHA1 49cabbc65218fa2853356f02b6fb7d6d9944b45a
SHA512 5c9300e027e6cc3a62d25270ce01ee5137aa516b9178b609c31c589d798493327e0d8a4a60bf5c51457e296db6398283d99bedb8f9536efa3fd49e9a484289c1
SSDEEP 24576:81QT7EcpfxR+N5AWAz3ooiYtjMqbXEsv20MiyQErBGGZWAsZ:hTDxR+N5YzTfjMYEiyZF8
TLSH
T1D655B02EA7F815E9D17EC5788A33C506FA727861073193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/176-308-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/176-305-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/428-304-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/436-303-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/436-295-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/436-289-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/460-410-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-418-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-445-0x000001D03ADE0000-0x000001D03CCB7000-memory.dmp

Download

memory/460-448-0x000001D03F640000-0x000001D03F846000-memory.dmp

Download

memory/460-412-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-413-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-414-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-408-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-409-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-406-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-400-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-407-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-405-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-404-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-416-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-411-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-417-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-431-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-419-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-420-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-422-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-423-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-424-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-430-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-426-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-403-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-402-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-401-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-399-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-425-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-421-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-427-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-428-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/460-429-0x000001D03D8A0000-0x000001D03D8B0000-memory.dmp

Download

memory/616-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/632-242-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/632-415-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1052-270-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1052-435-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1276-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1276-221-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1348-442-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1348-391-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2104-222-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2104-46-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2104-32-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2104-38-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2160-433-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2160-260-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2160-266-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/2160-261-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/2312-302-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2312-284-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2312-278-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2312-441-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2972-8-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/2972-0-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2972-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2972-45-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/3012-395-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3220-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3220-23-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3220-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3488-439-0x000000000F400000-0x000000000F408000-memory.dmp

Download

memory/3488-444-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3488-389-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3488-357-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3488-394-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3488-373-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3656-392-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3884-247-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3884-255-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3884-246-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3884-432-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4036-443-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4036-393-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4232-434-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4232-301-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4532-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4532-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4532-223-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4532-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4568-238-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4568-398-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4568-236-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4568-230-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4692-306-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4792-69-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4792-71-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4792-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4792-54-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4792-48-0x0000000001510000-0x0000000001570000-memory.dmp

Download