71d9beb7a3cc3cabd13122209f2634c43f62f3b2739233f9aea2100ecce7a576

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_953fe7dacaceaaa70861dd1aa5d0d6f5_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.0MB
Sample261022-vaxe2ags5r
SHA256 71d9beb7a3cc3cabd13122209f2634c43f62f3b2739233f9aea2100ecce7a576
MD5 953fe7dacaceaaa70861dd1aa5d0d6f5
SHA1 3a05e8c14faba350f227236aaa88e5f3f08827df
SHA512 1d287eec8c1ec76f8ffc85bf6c4dee1bcfb3bf944229a100941d67e362806e9460848ae4f15d62debcf71b76c2714f4ce843c058058e77613c4451c6ab160f75
SSDEEP 24576:FBYGb8a9t3A6nzSpx5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:cI8UA6u5SW6H8DS52tdDpbRZy
TLSH
T1A335E045A7E500F9E1B7E678C9A74A02E77B7C460270DB4F03E881772F676909E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3360	alg.exe
3936	DiagnosticsHub.StandardCollector.Service.exe
5156	elevation_service.exe
5568	elevation_service.exe
6028	maintenanceservice.exe
5060	OSE.EXE
2864	fxssvc.exe
5532	msdtc.exe
4852	PerceptionSimulationService.exe
3780	perfhost.exe
3200	locator.exe
2968	SensorDataService.exe
2936	snmptrap.exe
540	spectrum.exe
4616	ssh-agent.exe
1596	TieringEngineService.exe
5852	AgentService.exe
3392	vds.exe
4904	vssvc.exe
4988	wbengine.exe
6096	WmiApSrv.exe
2228	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-21_953fe7dacaceaaa70861dd1aa5d0d6f5_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7c3fa674bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-21_953fe7dacaceaaa70861dd1aa5d0d6f5_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-21_953fe7dacaceaaa70861dd1aa5d0d6f5_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-21_953fe7dacaceaaa70861dd1aa5d0d6f5_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050a8b4494562dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ada5f2494562dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b218c494562dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b76a164a4562dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000460c98494562dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2e933494562dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ada5f2494562dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058c22c494562dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027f4004a4562dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3936	DiagnosticsHub.StandardCollector.Service.exe
3936	DiagnosticsHub.StandardCollector.Service.exe
3936	DiagnosticsHub.StandardCollector.Service.exe
3936	DiagnosticsHub.StandardCollector.Service.exe
3936	DiagnosticsHub.StandardCollector.Service.exe
3936	DiagnosticsHub.StandardCollector.Service.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe
5156	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	632	2026-10-21_953fe7dacaceaaa70861dd1aa5d0d6f5_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3936	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	5156	elevation_service.exe
Token: SeAuditPrivilege	2864	fxssvc.exe
Token: SeRestorePrivilege	1596	TieringEngineService.exe
Token: SeManageVolumePrivilege	1596	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5852	AgentService.exe
Token: SeBackupPrivilege	4904	vssvc.exe
Token: SeRestorePrivilege	4904	vssvc.exe
Token: SeAuditPrivilege	4904	vssvc.exe
Token: SeBackupPrivilege	4988	wbengine.exe
Token: SeRestorePrivilege	4988	wbengine.exe
Token: SeSecurityPrivilege	4988	wbengine.exe
Token: 33	2228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeDebugPrivilege	5156	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2848	2228	SearchIndexer.exe	123
PID 2228 wrote to memory of 2156	2228	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-21_953fe7dacaceaaa70861dd1aa5d0d6f5_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_953fe7dacaceaaa70861dd1aa5d0d6f5_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6028

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5396

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5532

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3780

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3200

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2968

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2936

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2192

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5852

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:6096

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2848
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0c73e228022308b78803aab4e4df6dbe81f3c771063ce207875e742809c8b1da
MD5 5e60b6d42dc7ff6116136eccd1840946
SHA1 7abc4e9541eaaf6dbecb76891919f59096304edc
SHA512 ee9897dbb33fdcbe3a919dc7df9400f2e3542596b439e56a73d52f491361bb1517def291c72eb7f8a467da530b21e9eada5303d1417c4528022349f77402351a
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnA5SW6H8DS52tdDpbRZy:q3q6HjBt5SSDntdDpbRZy
TLSH
T190D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 73668d98a7b32a9eadf68b9a907ab5c2aa33f2cc329b0ae021e89185694a9074
MD5 c8af3f797e54b29edf0080eecb8cc18a
SHA1 e81680e33816199c30643d630905c3993759bd61
SHA512 ddb0cb48db10e7badf4d5365654d01c35381de76e3be87af463123c72b729ee6cd0e46b3bd7bac01575bd2ff02148bd8f8849efb4403ac9f43d6e4f4717a734d
SSDEEP 24576:7XYfDtczAR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:etca5SW6H8DS52tdDpbRZy
TLSH
T15B05022873E008FAED6B8279C8B28511EA33B8554760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0d3c7b8957c848c51a952f972fd05959d2090a3b80198a92ceef0b006bf14c94
MD5 733599c1d6c2ab04e96657577796b647
SHA1 95e9a7b53c0aee0372237eb04946bb0094ec3dd3
SHA512 8227dea24a04906c5a97dc3c1ae68f87661f3700d75df6c613db696fb16fbabdd8905becb58f1f0ce0319fe97f328ff7a93712c4727538acabe307a12137ba03
SSDEEP 24576:l0Le5ji0hmxirMo5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:lPji0AcP5SW6H8DS52tdDpbRZy
TLSH
T15035AE15F6748332D073C0B9C5D2A69EED7130865B308ACB4286D77C6F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 17eb8e528f4c757584cd26c468edaf6e6043166f8a44df5421ba900eb7c8c5e4
MD5 dc3dc94d08871981d196cfd7dee347f8
SHA1 97dcfd86c455b64e47d692bef2e99bd409dccb28
SHA512 a7cfd58daaddaaad6f1b792e918e8166139ac29e58e09ac8116ca82aab4954fd693a5ec2d5dc493baa08a044a5062d110dbca0fd812529e68c3c448a3e549694
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuK5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:R/ezSC6vUzPvxHjyj5SW6H8DS52tdDpO
TLSH
T175755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cf5cce2aa7ecdf2b7bea20f2cd78b7482c973a088e11242413e6feb4d1c3ad43
MD5 0f4fb32eb7f1c0a049ae2158fca617b6
SHA1 0a1e6096a3e059cca0a5c31e3bbaccd5e4ebca00
SHA512 21c881f518327ef4bddbfd2c2ee5182e34b628f5c9bfbfe0e0c49d0124c673b583c590ca22b350ed69664cde962fd7ee7dd67b258a634e5eb238a05437945023
SSDEEP 24576:1VbqPb88hv/l+6d5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:1VO88hXl+85SW6H8DS52tdDpbRZy
TLSH
T1A0559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 61f355b7598af7c7fde4e5734952db1284d8d9211415f30c66a5e2d1214da1eb
MD5 60654e672cd06a12ef944fcaa93eb1af
SHA1 acfba8ed9c76952d1f731aea0d41d48e1e602140
SHA512 bf3590b03692e9b726783d5f1b9bdf855a5e1936a7068261f47caa5e5160f26d8b2f5375e4b4da254f056087cdd66610a6ec3f9c4652a56247ac980274fb901d
SSDEEP 12288:dR05OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6/:dR05SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T100C423C4479030E7E31F0AB3F1FA96D5DA18EDAD8404563B4E717687CA3898FC576426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ff4c6c3273599f5357dec7d0e90ff82f2a61041f02749aa7289ade651a13bb62
MD5 a8fb246d7690d85c903d1ad8a1a03f19
SHA1 d05ef505a238f1267db5b672d65715ab2c12234e
SHA512 287eff2fb8c54bb2fec876d995ed75e93b43bffab261f18df0a9a5e60ce1b9ace5ee1ec0e28abaf14ed44c4518d5a086561428dcbb922e251b85de15d0ed0ca6
SSDEEP 24576:nJIUl5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:nJIUl5SW6H8DS52tdDpbRZy
TLSH
T1AD05DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820ECE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2b970d2acfd6e315eb8cad85beb8820e7e912fd19624ddbab5b0eb4807e6731c
MD5 4613720bbba86cee3ce88aa3001d07b7
SHA1 ad25ac9f514c1c2afb5c1782a1f69432c95eb2c5
SHA512 6ad7193ee6b7c575d0977653d0239750b6da985fed3b23d4d3d99189af208c8f15be2c0edf48fa60dd8266462dbef5aaae1619a41fbccbb9329b9e95187b713e
SSDEEP 98304:IQvGAdlCEL8c/yRNw5C65SSDntdDpbRZy:tvyEYc/y3w8ASintdDFRo
TLSH
T1E5267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 18ce6bbc436f9abefd4b7545e4d0fa63942cb34029cf3626cbb423b9602c8619
MD5 e2fe6ca4ea6183a753b9cebaf1e47fda
SHA1 4adf903ec4d717257f88220e252a61e030e10516
SHA512 eb7b2cc5461d887f22a16e21603d84880b661f70a09f8fafae2479112c5cd6760a2fa3228f31e35dbf4e8d3d60450cf540e8c5180008f26afd8f3f9bdc5c6d85
SSDEEP 24576:ddewsAj/5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Tlj/5SW6H8DS52tdDpbRZy
TLSH
T1A815E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ef2d84c566b7cc4b1c1f9a8b7cec667265590bbfabf793c7ba0a30b39923d7d0
MD5 944f0559eb18cb8986b18168bd003af0
SHA1 bc0d70a151a17a33d5994066d890f6b64adae722
SHA512 3b23176d3230171e2eb5ad63e8d4edfe3bc89ef319bad5f35f40a1a272771602a684da272e6f0fa20aa7c1199f47f47c43e8edfa6b2760b22c52b4935b0083e6
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpSintdDFRo:zUEtQevvqc2W1cpV2EI32YedDFRo
TLSH
T124474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d9a414ae413d61a1aefa9aefedb13f4cc2b88e0022555346db5008478f432993
MD5 bbec24d14822984f58dee7233883956e
SHA1 3c825778a57e49ee8fbb4ad7f203778dfb76fecb
SHA512 1fce2f32e870ceab3e33feb89e620d749c85c7a3bde96d5e14e4a3eb2aee3dbf56993c4ae72f521d7f02c219d1bf4fad34836f1abedcff941bce4899d8380c14
SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/zf5SW6H8DS52tdDpbRZy:/oq2Vjnm+5SSDntdDpbRZy
TLSH
T1F3D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7d4251d5487c5910d5ea5d001d145099b715b07ff1ab81cc9d0c61862ba9c3d2
MD5 dbd8ecb087db89c2dcded8293fc66f28
SHA1 724ebd2eeea9079f00929f434e35f7fd029fd489
SHA512 a2ff6f7e6d6836c605153d6f8501c918ce42e624a0ca20c36b63bcba819663e2c1d4e6e88f8ed0b74dd8a0360e557b13fadf3ef9165f32908f94acbcc5b5ea6c
SSDEEP 24576:gAhGLJIFoiwtA5l7S53e5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:gAMyFoiq5u5SW6H8DS52tdDpbRZy
TLSH
T13D35AE80E7F955D4F5B7AAB899B68171EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 39538f2f6a40ef845c7d8d5ed37cd63847b68d494200deb7878505adbe93e1f8
MD5 38386cdc93184e6cb288382d8aac6cc2
SHA1 4316720451d7f0c6f26dc40b998de2a08fa537a5
SHA512 818faf2fcaf86f817db0c5155fb7691ec22e3d9fb25ffc5b3078647541efd1c57e298be5655f8bfcc0acfb462cad2f3d8ac726cfdd5bce479953c6908311a234
SSDEEP 24576:IwuoOWD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:IwDOS5SW6H8DS52tdDpbRZy
TLSH
T16505F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f4f7ad4d9a826f95ee4d4c16447e669f8b36e6430d37702d6f90a1bb6c517603
MD5 ef4877699bcfb8a1718f253371604ed2
SHA1 654c2d68e59036e56773b3deecc6ed2a9972faa3
SHA512 29d0ecf4d05a396f76ee0f3cb9bbf380353a3816dfcc65e547211429db7330816ec3ab27b3637368e03cf29d1a954522757b155acaa73f09de4fe0f6e4f407ef
SSDEEP 12288:0BZ1Iyv5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Z:SZuw5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T177E4128923E030FBE25B42BAD9F54685D771B4A6533443DF0A60429B5F33AC65E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5c4f3865a4d3f70a1506a477f46f5dde1131cbba699b04a6f5da1b30a3d5a0d1
MD5 afdbff5abdb9e5ab2f7cf20cd3c8d102
SHA1 10b2333a1c2bb40e76fa7a177775c99d890683f3
SHA512 5a4f3936ce393c7df511920c7e5d5bb6f5adf6be76c857c5c637510e3d459725756447f04d2504e425d5bede9c2ca71a969aa55f35132171d5000b4f83db999b
SSDEEP 98304:RQRQyi36YOcPQLvw2gAf+PN3Z5SSDntdDpbRZy:IQyiKayX+PNLSintdDFRo
TLSH
T17F667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b1712078e4849c421f50f699620c0e70f84630a69ea46b5143bb1f5429611f24
MD5 5fbace3111eee7f36c37ddee6b6e9c28
SHA1 0d7bf138eb482cbe547e23dabe5c00378de169ce
SHA512 56aac46b4a0f7a346d5d281519c3dc58d2b922ca710f392a90ba5fd4bfdb41d7ba7042495477e5194c2b677dcb790d8fe6eb5f2dd720a288f2e10c643aeaeb67
SSDEEP 98304:lQRQyi36YOcPQLvw2gAf+PN3Z5SSDntdDpbRZy:cQyiKayX+PNLSintdDFRo
TLSH
T174667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 563b457ae8ebe8cd4e61f84cba34f9d4d4422fc3dfc4d32dbdcb68e570dc4137
MD5 6458a143943edf266a7ec25e0264564a
SHA1 5b258fc5475b870bc57be02397d76409a9ac502e
SHA512 f0d14dd3bbe33469faee43c6477ee0c86970d40b15142865f1bdb61f1096366843715a615b5af13c839ea625bd855aa9ed84f3ac948398fe9814d85ddceb4744
SSDEEP 49152:r68Qg55nhheWu7PNU3/P5SW6H8DS52tdDpbRZy:1thWRc/P5SSDntdDpbRZy
TLSH
T15DB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4efbeee0c2b57c22dc9827a9c964f01c2a6dc9116a64d20987d744d5b94eab93
MD5 ff2e97090648f85eaab4e87c0c400648
SHA1 271bb78b54a73898110f76d4328d4704054371e5
SHA512 25cc122b9e1c4da4a4c076df04afa989e368ae7194a0043e7dfdacc7729e40e85628deb81cb6da3d39bf125d679022d41288984bc2b2c27d3cf4bbd594e23004
SSDEEP 98304:Ky5112gYy5azzVvL69nLKnhZ05SSDntdDpbRZy:zLIHmWhsSintdDFRo
TLSH
T145167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1c88926e4a17469bf5fe2f9cc5b9ff664a74ba3c9854153f63a8e6d94a7555f0
MD5 1192bfbeca8940a5239e131e36803b2e
SHA1 5dee8a4bd161663e40309ba2d5fc0ed88a718c03
SHA512 a0d5e5e168ee9147baf34b56b034a47d7e8d9ac0af86641f6c3ea3cb1bcbc49250fd2483d90175edfce8b3d9870b2854fa541224da61d13f9ed0a836f47241d2
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glh5SW6H8DS52tdDpbRZy:Wu6JmVxd2dh5SSDntdDpbRZy
TLSH
T109D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6559a8c20a527bf1a8a95ee966e00ab29d85944d80bec7b418d4c6d68773961f
MD5 ab2c286ec33ae88474a78d7bad0c3598
SHA1 81467ea18fe6fce4ecd1be73f94799dcd41bbbea
SHA512 3ebe1aa909bc307d2860c810e8b9da67961afd909b11128da18f26e7a6b67cd1e7c42a13691feaa09de40a7a5cc68e6bdf82a00d09a60ccd53845b64156212f4
SSDEEP 49152:v1hpsNoJpF1A6UU44CwH7R4xF5SW6H8DS52tdDpbRZy:vmifPbR+5SSDntdDpbRZy
TLSH
T1FEB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 78920862a55dc058ee35c38de160bb59a49cbb3edb9cf31e1e370e6558f87743
MD5 cef9c06659ef643bd8af327d51a1d3e0
SHA1 8e941c56e0ac6341b1e1f37fed9e55ec9470354a
SHA512 d4de324b87039dc583da5993f34de78cb53adfa07ca2745f3a10bc7151a4ef7f596b4c600b05900d99ecbf0f93275a105cb6db26ace9d5a78aad9a1e6c02504e
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqw5SW6H8DS52tdDpbRZy:u5dKTi61w5SSDntdDpbRZy
TLSH
T1CFC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 51fc7e42a2334dd9d2af127ca68ea1ab863f31fe6a8406086ec849361084c1f5
MD5 d1b4cc1c32ad4b185854f6dd49ebb6f8
SHA1 fc01b90851c44b51473d5a8e2334b95c93dfa0b6
SHA512 3475a4d4556c17d28184b7ae16774662aa73fca109be2b3c45e31597b72881cf1d32feda04641ff8704aef9f41da546ecbff8d653a16a5a6507e6254e1116740
SSDEEP 49152:0htSn8EApI0figngiDn0AP5wR5SW6H8DS52tdDpbRZy:VX2iyphy5SSDntdDpbRZy
TLSH
T14A95BE13F2D900E8D05ED175C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 82752a50e33ef841d52975aa12cdde8cdeecfe83a44b76ffaab7e90621bb4d0b
MD5 fe3b59708ca9b048127113ff1c372203
SHA1 83038b3a0c7130f91afb0c3cc97bec340f9cc644
SHA512 c8121949c1707147eaf029e57a6ed84fb370b59eb891622222513c82d770e292c0cc956ba908b03f06cd6e58afa152baf865a55e341190d524f0d7ba72684490
SSDEEP 12288:u85OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow66:u85SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C1C423C457A121EBE30E0AF3E1F686D4DA0CA6EFD408623B5E716147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 724029d07458fb6843a68c362f602803aabad3e603d89db0bfe8c55b6aa16e78
MD5 1ca6505bec7f3975f756d6c04ea74af2
SHA1 5bb7971b4da8c79ced732357c0240cbc32dc69aa
SHA512 8729f61893e6ff1cc900c1f43c59b68483b5eec604b83d4050f44b0cecc69527f6712fe1ae79b1e5e99bd9be18c58d8f727873bce08e3dc21e31be8e42689924
SSDEEP 12288:v75OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow66:v75SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T154C423C457A121EBE30E0AF3E2F686D4D90CE6EFD408623B5E719147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 65308151c9bbac76df6b51a7cc1796fe7628bd23d9191fb7087e61d6cf750136
MD5 94273325d6223dbd082d0ed708c22a91
SHA1 1e8614c650f217025134b4bd503ad048ecf97200
SHA512 cf3d704863b62e0673666927e6ff9fc2f229a9110847d5e0b9ddec6b85b8df39096a4a7e31614473db1bed518388762b977aa37c65c70f364ed367475cd7170c
SSDEEP 12288:5t5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6K:5t5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15DC423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ac1e4babf09f23e476b1ade0bcf5e3cb90d7d008b6750c69eba78406bd16f17f
MD5 020edadb7f413cb706aa45aa8e85371c
SHA1 1c041ec2c1d76e2d3cb6daadd41f7a0ff33bac61
SHA512 115f08e64f3dd5b50f8446b4c65dcb8125cca368cd8c4370b5e38ff8b62cf9a6104703bdf0ab1942aae4b778fc6f9c802ed4388ab45781ae343bc193a94449cf
SSDEEP 12288:iV+5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6X:T5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T14ED4238427A121E7E51E86F3D1F682D4E628F8EED524637F4F20054B8F31BCB9935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4af4a612bc126d094397fe657e0681eb04550e2a8d5a1951f86fe7e3dab223c1
MD5 c9c663abfd6417fe3c9c95c318b2b6d0
SHA1 e184623aed292ceb8222bbcd43fe8b06cc3baf4d
SHA512 18f4ef6b40b9826a8d091efd749374bedde3381e434475139f55681f1d2d63a929d2849d5adc6a7563d7d48304ce0638aef462690e0745ac0ae16498d7dea491
SSDEEP 12288:QW5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6K:QW5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T181C423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 16fcc156bbb4c9388f51c89845a7a22a405eee4da92312848cb3180ed5ebbec7
MD5 3e862795d7791de61c12b76b689718c9
SHA1 e050d1b1c06b127b7ebafafd2158bb0f98ecdc4b
SHA512 5f504d69094a5b5dc9c9bad252e038516c5adfcc9d1a6a4b04020d33f55121eb6a9c0b7cfe127698378f0873d92d7024fd8513569e99a22c9e3fc7ace5108ee6
SSDEEP 12288:uH5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6E:uH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T17EC423C457A121EBE30E0AF3E1F686D4D90CA6EFD408623B5E719147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d8c5f3e78694d6f5360cb845ab4cabc261b99efdb1246fd470b72f6c9ee9d6b1
MD5 da7ba12bdc1697aec29855d9cb350323
SHA1 195afe9f2b190550e7e138cae4ce8f8ec62de817
SHA512 7949e9c79b67f98ec1114d91cede9e8680108227c2ce365e8b2ef64df574d3ca8de8d8201130c490414ab5e2371fa40e824a56bc7ee88d6812d8674412ed7f46
SSDEEP 12288:jT5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6c:jT5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CDC423C457A121EBE30E0AF3E2F686E4D90CA6EFD408523B5F719147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6d53fe84ef2817a390364f240c244cb3c1ce3b1568e95faeec34cba3694468cf
MD5 8538ab9131904ffd288a22df77f8e615
SHA1 a3fede2b0fd3b5919d28e5e04295431f41ab0da8
SHA512 cb96589170339551b1b407013359dc675465a03226121e4561324bf829b678178690415ed2a2cfe5f4423edc5d896419b9262149b52f5d39348a276e4eeb8fe3
SSDEEP 24576:5ZMSzFVSOb5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:5ZMSzf35SW6H8DS52tdDpbRZy
TLSH
T11E050294B39018FAEC67823EC9658945D6B2BC5A0760C62F07B436675F333920D3EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 68b27956f5058fe65ea8024dc0b0f027b96e5abcb99244d79051afe4c767268a
MD5 bbc43bdfd7e6fe32b6f411e84cbfc55f
SHA1 1a0a52e3f9c209c4607212234f9f2f4d5b6b1744
SHA512 49cd64ca75b214b0533d655051b02e24906951c91837416f4bf07e26bea629fd05eefa10be3188a827b64fff233a16694987ffec03e3ee36126254ba3ce470f6
SSDEEP 12288:yg5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6s:yg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B5C423C457A121EBE30E0AF3E2F686D4D90CE6EFD408623B5E715147CB3598F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 59639711b92007e098618cfae15e4c39c520a04a4c06abde786596afa17afb00
MD5 5ab82a12cf02268cb79c0a716e60bdf7
SHA1 70de7fe7c9bc6c551c94f230322c92d25e131663
SHA512 9f5b0bb63482576fa5b9150f9a1eefe08d1e8e0a86f2a0511875b31107e259483a7d3b8b161b79d27f893f13a6b5e19b0297af3e995efd78be6882c6974f2182
SSDEEP 12288:Xk5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6s:Xk5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T108C423C457A121EBE30E0AF3E2F686D4DA0CE6EFD408623B5E715147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 9b3dfcbb7806841bbfcf8b3fadd74751175b962f96017e99530c16052ea7e25a
MD5 b93f99e97c09f46febd1486d2bebcdb2
SHA1 4703e6a206ce78f1a5f000d0fa9fc2c77c695d35
SHA512 bdc84ffc53d137306789c90d89c1963b98a2f821f7f6e25c6393d79e660254af67dac845af5dd4d2f4cc5aa039485806fcbc32742e51a6587d7bdbacc2b3dbf2
SSDEEP 12288:2yPz5L8v5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6W:Lzyv5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T149F4024773A130FAD12B4276C8A20A41F775B87647248ABF1BA047775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0df7bc2f96191b56ace89a24e77283893888ff3c33d664433b6d8a8090d62a46
MD5 64bfe37500fa67827f42f1a1a025de03
SHA1 d02b01f422d28d2978a4ee91c58260e76de8b3bd
SHA512 b407a907b669038c21cf556949e44770110d92d04f9d8a063dc5552ac144c40b8042d006ef3ba4039fd22a250cc9207c51f0993ee9003e6f4b49730a9237063e
SSDEEP 12288:bg5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6I:bg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1DDC423C457A121EBE30E0AF3E2F686D4D90CE6EFD408623B5E715147CB3598F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 389e7cd37290dda009b304e0c4ce398a49111e646d4b375c6fca8747ef761d13
MD5 dbe11be88a608552ac319f3affd3072d
SHA1 c922aa679b241c41890dd4463b6af676eddde122
SHA512 cc5316a995b15d98acb6473613a28967944952cebb327ef995d5b213e9517f7b09c0543d83f90247ca061ffaf9d7d15bba051bcb0989d85f966a6b397d2c9240
SSDEEP 12288:Qg5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6n:Qg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E5C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E715147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 ec55c255b1d9a6edce5c76637b23758e9ae30db6354eff0b2f8670d889068b27
MD5 10d4cc8616718f91fbfec255eb9a6d5a
SHA1 c5718546ad091f1ad017450760ac9070582682ed
SHA512 9ab8b516755a9fad278a8ae2b72bc4c947af55448d1d728ed8e0fd454a9198c0d3278027fe7465da04747eb90d515339f40f65d5d551c5b32c3c8aa1eac5f45a
SSDEEP 12288:TyPz5L8v5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6V:ezyv5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1ADF4024773A130FAD12B4276C8A20A41F775B87647248ABF1BA047775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8bde9979b8c0d66a373cfd635cf2222d78ea5bdbb24fc7467c5ada1494578509
MD5 1439e878e3deb0335f30801f8be10c33
SHA1 99c68a5b20c74528e2d20e8253e8f5130ca46353
SHA512 ac879ef73c740f53e5ae4e80f6fcf22fe3d3b539f106b90e0dea1befb63ccd98ede80201367039ffd7acac6a7c0a06735d5dabc454bb6f28b35115144c20e4d6
SSDEEP 24576:3THaLl3z0zD95SSiVw6uAX8DS52tpz9ZRzbPmSZyo:3T6LljK5SW6H8DS52tdDpbRZy
TLSH
T13B050294B39018F9EC6B827FC9658946D6B2BC5A0760C62F07B436675F333910C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ac8ae8761a0de70c3a69f6e559e6538cb0a7b5ea8a7a8a0b2971cfb63f48ae2f
MD5 7e44f7ec1153ae308320bed3f7d81cb1
SHA1 a9eef22ee8ffaeb96238ed75291b193f6cb05eed
SHA512 c80dc03f09d80256af6e88d13c99a7862e6e3b9abd3f009712bfb27a8b25086af3e332767305b85035a4738121608d73455afff16b4881804389531234039e60
SSDEEP 24576:c37d9CHKy7GZ55SSiVw6uAX8DS52tpz9ZRzbPmSZyo:G7d9CHKya35SW6H8DS52tdDpbRZy
TLSH
T1C225CF90F3E410E9F1B78A35C9768511DA767C9A5B30DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 4aff972e8e6bd06b43c61a04ca7293d9cc2f81152123ff9bd27bdd4c78131053
MD5 7cb12e63161d7c070b8565f3e95a2ab5
SHA1 0d883f5a03d26e2ed303d5e1d2ec3e822bce8d78
SHA512 c6bcb7612bd20b910eeb322f3965c424ba1a8bb87641257b89988d884cdbb45328532d1db6cd278470fb8b8bb1b3ecf6cd1f96d0879289458ba1331d0c148349
SSDEEP 12288:nN5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6d:nN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T11EC423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 635b16cb04ae26e2067638d351cf8ff601ecc29e165cbf6d39dc6bb50c2d504f
MD5 59ba05c4a954560625dc698b4f954884
SHA1 d1658ce410c34f5f56c257d169809692c543a518
SHA512 081542ba9006d83fbcbf9701c9197ee7841154c22cd17850c859c825d6d43f298e050154d0e004b18b8a3c5a184b21d222f90e0557d81999f7a9184a6a9e328d
SSDEEP 12288:PP5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6V:PP5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1EEC423C457A121EBE20E0AF3E1F686D4DA0CA6EFD408623B5F715147CB39D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 6939fad83ee72ff68222661600715bb891f92593a0dfe6a511b02e3954d08807
MD5 39db6e46734380dac2bbe1ddfc867fd0
SHA1 660fef4c784b586e270c9c1e456fc4053151eed4
SHA512 523c3fc4e7cc8b498b9ec185e4a5a763e09896a225293ba64b5edc962c0be9b7aa8c3b78448143eb03a88f7170276ca345765e4fbbe3f145aa1740d364d17e93
SSDEEP 12288:4i5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6R:4i5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15AC423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B5E715147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 d2887c01b6252d21e87b49039bbba27a6c048a099761c8b749d391a6b83b56e8
MD5 2bb4741a5d46228fab1adb35f99492b4
SHA1 8e5d23453e98b7a70b35cebb9c404cad00063d9d
SHA512 0fcd6a86c03dfd9c20c3f0133cbdff7cc86e2d061b4de69987325047170452cccd8a6430007aa7a1a20fd97b9e42cdc5538234d5c6b8623d9624558e895e4793
SSDEEP 12288:uNsfw5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6A:Xw5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D0E4F149D29412EAC01E5276C7A64A80F3277C6983E0D3DB5BD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5e2e9778fb729a20c8c78d2f57cb4c9b82283777e18f0d4b63fe511af6bb7dad
MD5 2af0d1283e98233de693a0b689857630
SHA1 e86b1b71931e094aad27b561711a455b1ac73e23
SHA512 829d2804602b2a25bc3637785971697e19077ad19aa5dd0e1f5d3d7960d85f1086bb2d6cd716042e1c7a5169955155f6fb9366944f7bd5f185dda18d7115167d
SSDEEP 12288:up5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6C:up5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T17AD4238453D43557F22E1BF3A1F6C2B4E61CF6BE8904913BAD2051478B34DCB8D3651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fa4be84a692c551629d115181cabebe00a09d2df5e17d35145291208c1e365c5
MD5 0593b88ce42a7c9b31dcb3e1b57f3ba0
SHA1 1abf11397c2b86ea826a89930c4d63f7a2dfc712
SHA512 aa941d61df62a89fd26d378ce252f531e088b678f25859bd96a3e0a04f067d35b4d1b4e9ae26e91f1bf31a770a958a2e1cec10813111ffad8c9d3e0158ed05bd
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQf5SW6H8DS52tdDpbRZy:5a0hNYG4JwS5SSDntdDpbRZy
TLSH
T14E85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 d0fd59ee6af68637a06f81dc349e63e6c020c41cbebf8786bedeca62b9feac27
MD5 0a75031e1eb54f40690019b3f8572f07
SHA1 6a00906f511dad106b3caa0e3a1c710a511bdcef
SHA512 91854315c55eecf4357ddbcfc783005821d098c7254376793fb34010746ab6b007fb4d0f1146b1484e2c28615217e5e85d0985be97920476bd8c64ae63f4c407
SSDEEP 12288:xhbHjfXE5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow62:xhbHjPE5SSiVw6uAX8DS52tpz9ZRzbP/
TLSH
T165E412AD13AC20DBF13692BE91A68646D330B86A071093FF1BD1827A4F37ED94D35E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 79f72e00d04c5fe0930c31591a441f24d6810aa4cb393d475b6b2f0985247cc3
MD5 0bc22c54418830ff89772fab33ce9365
SHA1 3d552a8f5cb1a513027d2cf4af476d82e595ae49
SHA512 f8619d7b35c44bf530ce7764b9383bfe0ffd4652fd4fc847e4db59e4f39cb663c6ba3a469613b52f7d5ad2f91b5f74d296a831925786dd90d594b13dbbc7e604
SSDEEP 24576:N3YgnJcRTk4yti+R5dBR/e5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:NIgnaTk46pBR/e5SW6H8DS52tdDpbRZy
TLSH
T18645BF2DF3B910B9D8AAD236850147B5FB71782D1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 95bb32782f9d14b69f63ddda365db6e54f082b4152710ef1be66c14a2d9f161c
MD5 63fde65793afb2765c67c1b0ae5e8806
SHA1 64badfd0d3ee27245058b2c20baa57cc88098363
SHA512 b9b520dfe95a388ef0fb816f487ce2f36916723da0adbd1df71d268f00f2af6d7493a7026174e5fa3f861dc71f2f9d50dd67b6863a4b7132000066d2ea7b2ca0
SSDEEP 12288:jN5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow66:jN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B8C423C4539135EBE20E0BF3E1F686E4DA08B6AE861812FB5D71A147CB35DCF8636425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 7b52012ea133b58fcc5d6fab4d9da03575b69ecca8d29c6c94c2649c6475f6fe
MD5 46dbf10f539d11db0bd2495c84cc9038
SHA1 4af06e38159ecc126202328d8861e45765b510c3
SHA512 8342f7cdae7724525782fd2190f753d95c52cba9bca4b8c2aaaef9e8aeaa408bc4ec8f6a9aa489fb693f979a6d7a11916bbfb69a4f18e99f8f7734f6bf54893c
SSDEEP 24576:OpL3UTU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:OpL3U45SW6H8DS52tdDpbRZy
TLSH
T178250154F7A400FAE96B813DC5B68616D272B49D0324E7EF07A84B561F237E64E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 8fbdbf9169dab490cde77afd4d6571dfb2b347a21248b3ef9cd94be771680f73
MD5 0d7e82131190973c87356b5f8be8a48f
SHA1 3352d004f168cae955c7635ee569b984d74f0186
SHA512 ca4e89a5ee5fb6c5c35a570de31a8d713b8cec506679cfae8c1e315cd7726c41a5d9214775397886d822fc1a4a41d97cb062f80abfb9f671d003b8276a9eee06
SSDEEP 12288:7pFtpOY5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6g:HOY5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D1E4025933EC20E6E13A527E9592834DD771B4A6071053FF0AA081AF4F77FE95C3AA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a58824fa37eaba2cfbdfc75285e4b41344ead1e9390af5685dd347d716633b90
MD5 9de81bb070bc25f3b4428c35743d9b2e
SHA1 09e7c1e97def1004cc71624495491f07a56ccbe2
SHA512 019b9d2a8b741b6ca8d5bf5b4f2ed26a191387b58f15b9a89d6b90b65dedc3ad6f79e6481c67106d97a06933cc82cc692624284f37cdc9298cb0e655893dc488
SSDEEP 24576:s7NM9YqZqmWMUkPjZM48Mv6bEhs55SSiVw6uAX8DS52tpz9ZRzbPmSZyo:s7cBWMpPjN8DbEhG5SW6H8DS52tdDpbK
TLSH
T19065AE2E6BAC81E5D477D13DC9E28205F6B1B4611B318ADF1162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e842331bc5f0e7ea04196a5c94c016559c0b49f30054b83ea89fb0f9c29557f5
MD5 0775398267151e474a8fe5259628a544
SHA1 bd161aa1b392fb19fd22a7904c323e927628bd6c
SHA512 cf10348a412217cb83c29aa5201b1c7920168f62343e9cf2256c23a13e22fe5f2e542e7d881acad8406b03d6946e52853fb04c9e03c34b5823ebc2b0c3e3c740
SSDEEP 49152:AF2YuHNETovAvNYf8kmZ5SW6H8DS52tdDpbRZy:V6BCf8kY5SSDntdDpbRZy
TLSH
T160858E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4065e47540a978a3e88689277509080ef90449b8059702f06bf25857599fe626
MD5 b8fbfb6947f543fb830e85818fba5064
SHA1 2350be286907f47614dd16e7196b2f5d2338be98
SHA512 324aac6761f38381faf3d7b8ebba75545f6c65a59491b2792a792a382c465a5e9d1485f86aa6f1123ec8d05c8772d9be61be14387c44827edea246e87646fa22
SSDEEP 24576:ZAFs06+Omlf3NXEbTo85SSiVw6uAX8DS52tpz9ZRzbPmSZyo:eFs060lVXu/5SW6H8DS52tdDpbRZy
TLSH
T12D65AF2F62EC00D5D07ED17E8997C91AF6B1746707255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 32016e751391309f17f79632f14d11bbdcfec3d10856f2797838e0db0db6d556
MD5 08218277292547010807545d9945bb42
SHA1 49a1c0656220a07faee43f2b44ecf6356374f8a3
SHA512 185ef11374bb7fcfc85fc99c54527b7cd424de90dfcee465860ed1c961770e7660234b53c3a4e13a1fb9a2380ab9a8ac99529320967d3eb81ae84011f2ea4374
SSDEEP 24576:gJnJ5D3WX/5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:gJnJ5DGX/5SW6H8DS52tdDpbRZy
TLSH
T1C415E02CD2A810E9D0B7C2B4819A1795FF72347D2F216ACB28B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6d321c2e0ffb6d5be3d1d7b8143aaf7f20af6a6ea7b6cb2b3077bb176cccf628
MD5 3a7501316d7173f9cdbe71f9aad48a92
SHA1 261d4ca81c0922ef8649a0c0de1650de64a454c1
SHA512 7cfc84ec3f5181cd06524c1dd7fc8013a3ade2211fbc394dbe45b9558443990adf98f19a96e7413af81df085af6311be1c1af91a1d2ef516a065399502ae6ed1
SSDEEP 49152:ig06DIKdwc+eQnSt65aVV5SW6H8DS52tdDpbRZy:bL5SSDntdDpbRZy
TLSH
T1AA956C05B7EA5295E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5ae3516829c68d9194126061c8671b541e255289fc4a64cf4417640ed24c5ac3
MD5 965a1dfa5a2f77456573c8f2a48ece14
SHA1 b159df69f64ea454922c6716b8d1be1b939ce58b
SHA512 692b0691e1a4ffb608ffcbaf89ed893f6835878b33f8cf6910b2f70df70f7c270e6858a9f04dcd45f38fb8c2e4fbc5a9452f6075246beee57571d0774265feb7
SSDEEP 12288:UEP3Rnx5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6h:Pnx5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T179E4129C27AC30EBD12A917E91A18644D371F0B5571127FF1AA1C23F8F37AEA5D39A10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 389e8431b97db1fc5070b2dd1284c572c3760d2da2890a9469015580314dc799
MD5 8a06d7329a982bbc56ba073274dcee27
SHA1 23fa213b96253170bf824360f81a51640db5a42d
SHA512 eed301e0125a9e39704337cd7cba883bf5617c62cc172cdaf75a32b8619e73be66596ce5de5b2647f9bc855fd582796af747947997ca08d5650fe372c038cfcc
SSDEEP 12288:qjkyW5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6P:qIyW5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T188F41244239420D7E66E0676D6B382E0CA38FC715B1053FF59A0E22F9F36BD69935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 01920c8c429f02b395f1c4eb084da408ada2f36655567fa7a79e9b583a283d7b
MD5 df35a6bffc398cb1d7982706b6742d04
SHA1 538edc819234875bce71619bf543b9950420b19b
SHA512 43ea157416dc81fa55d789b8196a2ee36bbae6e12e23d9aea479a48b3117b53c807458bfbb7d3093b0fef8e012aee3382716a5a669febe0c6f96fe11d5c9f929
SSDEEP 12288:byI5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6H:GI5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CED4238813A131ABE60E06F3E2B68AD4D618B1BE571462FF1DF0E167CB359CB8176C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8729bc4c46e8b0feff3cccbec4af43da5973eded018ca9a37696e8e00176b768
MD5 60aef1e501090ce54f4374931ab2063c
SHA1 e7881dfee87e435bf134a14f59f3d1021a8d9a46
SHA512 638a5e3c4db57c26707e58e596c8afcf6b311af42ee8442a421a127d20de1c86602316dac91a214d66dab63df374c23b453458eb0e4cbc6ededd136492b53204
SSDEEP 24576:XQ9MxZKdcz9dw3h5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:XVKZh5SW6H8DS52tdDpbRZy
TLSH
T1E5558C2DABE9059AE177D275D5A240C3A633B4311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 f87d8dc52ee8ebb4a33440e447a211a54d55217c3754cdc301b6e04a007af8c3
MD5 ff320d14d20cad75bf617e75fbbd9f03
SHA1 8225ce3f58ff3cfe39eed76e14e7d444bfc68aa8
SHA512 0cc9408d8e17c206c669c814f56b0c94736c6d6c24d6e26f7a002be39b8bd3fb5681e97c7a2198324289ea491ec0b903c0f2727f5a171c7526d75ed770f60896
SSDEEP 24576:vyocDApa5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:qocDApa5SW6H8DS52tdDpbRZy
TLSH
T1B9F4E05FB7A940E2E126823C89858345E773B0745B2163DB5A91C33E8F27AEDBD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ef59f84ca1a09d581a3681954c05e3a596bff68d811ed492d073b351296bf830
MD5 646969b0a6e8e9c9862ce9a465ca5334
SHA1 44784defef0225d5a30935518dedd3b66069a24f
SHA512 475e32e66db14f5dc74254be87ec7082ef873ca66b055149a648f0428394d76f494d6a73a2cd84c3ae8bc12a61a536a628502e69479a065d6e956c7f93abd132
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKa5SW6H8DS52tdDpbRZy:z0zuNIU5SSDntdDpbRZy
TLSH
T120A57B3DA2F800A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dc8817b4367094dcfa55326b8e17a62a0486f581c084791e77f03ac80b4605d3
MD5 133031287f9da015653208ebbbd86df0
SHA1 b3608f2484886b94c3ca25c2d5fb227de2b4eda0
SHA512 dc7cac150d03a48f67a1114ffad2e2372c84ae3a349df0352b81dbd43afc9c64626c8dbb0b9a5df5dec2e261acff6bd161129b13d4c85c9b2b4fe3d8dd041e85
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYtjMqbx5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:3TDxR+N5YzTfjMa5SW6H8DS52tdDpbRo
TLSH
T1BA55B02EA7F815E9D17E85799A23C512FA727821033193DB42A0C17E1F3B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-286-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/540-414-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/540-292-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/540-285-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/632-25-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/632-27-0x0000000140000000-0x0000000140119000-memory.dmp

Download

memory/632-0-0x0000000140000000-0x0000000140119000-memory.dmp

Download

memory/632-9-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/632-1-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1596-308-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1596-416-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2156-447-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-437-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-432-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-438-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-448-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-417-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-418-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-419-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-420-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-421-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-423-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-425-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-426-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-427-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-428-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-429-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-424-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-430-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-431-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-433-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-434-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-435-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-436-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-422-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-439-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-458-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-457-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-440-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-441-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-442-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-443-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-444-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-445-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-446-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-451-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-449-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-450-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-452-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-453-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-454-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-455-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2156-456-0x0000027F4F600000-0x0000027F4F610000-memory.dmp

Download

memory/2228-412-0x000000000CDA0000-0x000000000CDA8000-memory.dmp

Download

memory/2228-385-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2228-350-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2228-366-0x0000000001900000-0x0000000001910000-memory.dmp

Download

memory/2228-534-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2228-333-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2864-242-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2864-247-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2936-282-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2936-408-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2968-533-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2968-279-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2968-332-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3200-327-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3200-275-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3360-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3360-101-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3392-529-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3392-316-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3780-323-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3780-271-0x00000000005B0000-0x0000000000617000-memory.dmp

Download

memory/3780-266-0x00000000005B0000-0x0000000000617000-memory.dmp

Download

memory/3780-265-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3936-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3936-24-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3936-28-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3936-208-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3936-23-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4616-304-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/4616-297-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4616-298-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/4616-415-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4852-261-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4852-254-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4852-319-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4904-320-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4904-530-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4988-531-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4988-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5060-235-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5060-74-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/5060-80-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/5060-73-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5156-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5156-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5156-43-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5156-34-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5532-246-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5532-315-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5568-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5568-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5568-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5568-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5852-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5852-313-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/6028-69-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/6028-58-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6028-65-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/6028-59-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/6028-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6096-328-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/6096-532-0x0000000140000000-0x00000001400C6000-memory.dmp

Download