f0250c9674f059526d5f93f07d4e504a54d2b51b6f45d848d2971b9ed0d98964

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
Size 2.7MB
Sample260511-e4xd5abt3y
SHA256 f0250c9674f059526d5f93f07d4e504a54d2b51b6f45d848d2971b9ed0d98964
MD5 d8162e4f32ab4ecda1a4d499b48efb4a
SHA1 c73a0f73baf02eb630c6ec784938573d70a5c396
SHA512 541c0cd87dfa543d176a0bf06de4ca8c33b00f135020c456d9e6bcd86eaa7bce63e2dcadf1bc2b90926b5046e566515100d511cff1c3807911575b96f1dcfeb4
SSDEEP 49152:fumKCy6ZsUmbl5m6BSDf5FA330fsUdp9W4LUmO0CGLfJ4klKXnd:BJjB2mLfJ4k
TLSH
T14AD5AE17F29A10E8D05ED1B8CB598232EAB17C490B25B5EF0790B6652F37EE45B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3912	alg.exe
3076	DiagnosticsHub.StandardCollector.Service.exe
4248	elevation_service.exe
1280	elevation_service.exe
5532	maintenanceservice.exe
5292	OSE.EXE
5388	fxssvc.exe
3516	msdtc.exe
5332	PerceptionSimulationService.exe
1572	perfhost.exe
5288	locator.exe
5180	SensorDataService.exe
5720	snmptrap.exe
4144	spectrum.exe
3264	ssh-agent.exe
4584	TieringEngineService.exe
5392	AgentService.exe
5892	vds.exe
4352	vssvc.exe
3924	wbengine.exe
2024	WmiApSrv.exe
2380	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c9706aa5e7d1e4d4.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a8b8a1affe0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cbb5e1bffe0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005577771affe0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036ed8c1affe0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3a4e319ffe0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3076	DiagnosticsHub.StandardCollector.Service.exe
3076	DiagnosticsHub.StandardCollector.Service.exe
3076	DiagnosticsHub.StandardCollector.Service.exe
3076	DiagnosticsHub.StandardCollector.Service.exe
3076	DiagnosticsHub.StandardCollector.Service.exe
3076	DiagnosticsHub.StandardCollector.Service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1480	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
Token: SeDebugPrivilege	3076	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4248	elevation_service.exe
Token: SeAuditPrivilege	5388	fxssvc.exe
Token: SeRestorePrivilege	4584	TieringEngineService.exe
Token: SeManageVolumePrivilege	4584	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5392	AgentService.exe
Token: SeBackupPrivilege	4352	vssvc.exe
Token: SeRestorePrivilege	4352	vssvc.exe
Token: SeAuditPrivilege	4352	vssvc.exe
Token: SeBackupPrivilege	3924	wbengine.exe
Token: SeRestorePrivilege	3924	wbengine.exe
Token: SeSecurityPrivilege	3924	wbengine.exe
Token: 33	2380	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2380	SearchIndexer.exe
Token: SeDebugPrivilege	4248	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 5752	2380	SearchIndexer.exe	123
PID 2380 wrote to memory of 1364	2380	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1280

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1940

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5388

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3516

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5332

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5288

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5180

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4144

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1612

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5392

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2024

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5752
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f8b5b428321a902d5c431914d2a2a0c1f67ec040fd46d57fced17cda42a28ab2
MD5 b4808db5d14a1fdc83b1d94446170f72
SHA1 a2ae02c05e14c2ad5ff62d47fbb9dad536a45a87
SHA512 5b2056e4084b993a29594229d24ad3b3da8a22264388912ebd876b98d97f9e54820dc2b24e880985d8da9821e85da8a6e4acffb22af189c5387f5becf720957f
SSDEEP 49152:Gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnafJ4klKXng:43q6mjBVfJ4k
TLSH
T126D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4c6ed6d12b3bbd45cacd3181960f371248f20c31973164f451fc9b4a5abf859c
MD5 0bbd6e48422dc2ed5686c2f6147dba64
SHA1 64fa6790517181ced45f8cc2f47571b62de7b60a
SHA512 5c2df7efc794266c131996c670e3e9d10aced496afe3112b9a5c962519a97425353a97fdfee58e25fdd85b852f2a755a71b2129dc2698ad2d60ebd1b3d820fd5
SSDEEP 12288:m1XLsswWkxy2lRq2czAhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:EXYfDtczAhfJ4yL/tNCJPXUQrPu
TLSH
T1EB05F12973D008F9ED67827CC9A1C101EB32BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5040bb0c24cb3a64faa849bfbba344f03b2aaba4535c46f5c938fa7f3103e66f
MD5 e4af31e0299e10b6eab6d77dbda24c42
SHA1 398cae07fed694982dfad826c11a5507a839df43
SHA512 4b8f46ca69b278e39faf0855169cc0a91878564e7e88bc45e75a409dc118c145f3540d8f11d1e59cb4f4ece10d30a7d4039f2728993e67aa92476bfbb395f829
SSDEEP 24576:p0Le5ji0hmxhrMifJ4yL/tNCJPXUQrP2:pPji0AzrfJ4klKXn+
TLSH
T1D935AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 61394b5f92d99fdc2a9d05b5030863218229eca81a8ccd9b52c07d2e67a79e93
MD5 9f1afb5998764bef8832b22a64395ecf
SHA1 2fe810c9cf29647b2e9f6674f8ce3be7b3e3fa75
SHA512 85614d5c42e9938bd999396288e8b721fd79a5ca3a3b230525affe3e9155c45c8d39c796a4d643f92cb241b98370668fde41ce1054475322b99ca716e3045d91
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWj6q8wyugfJ4yL/tNCJPXUQrP0:G/ezSC6vUzPv+HjynfJ4klKXnM
TLSH
T158756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5d056c6adc67660cabe67ffc26b71a23df9bf9db1e33ce5bb5982bf69f054738
MD5 9a2c004c809e371e0c11e4388f7c3343
SHA1 a32ba5316b7b3577d53b51d02ff627f96d3c649f
SHA512 af40defc6906cf5839483b9d6e7562fa16ed32cac2ab501eda5756f8d79721453672005328d6393c45c7fa830c89a3f68ce67c2079db15a6c592866cbad6b139
SSDEEP 24576:NVbqPb88hv/l+BFfJ4yL/tNCJPXUQrPf:NVO88hXl+LfJ4klKXnH
TLSH
T1FD559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 39690cb1a154e8cbb8e98162a17d4395c1d2a71781d7419441f77fb3e1b722ee
MD5 586e433ba7fb58912ffee49ab90f3ee8
SHA1 5f8cb9f024fe5d587ccfc6f53dec3d14db9abf66
SHA512 a86fa3cb9048448827f59e9f81ca50783662af2ad0d56eb9ff7954b2145d9dfe02efceaadc053f298c4451fddf363f8d866c36de37c323ad412a906b1a6804fd
SSDEEP 12288:nGWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:nGWfJ4yL/tNCJPXUQrP+
TLSH
T145C423E751809486DF6687F82A88F001C704BEC5562FA2F6DE82BC857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9ac1c4185a0924d9e22d565e0deccbc084e6222f64a20f85917357115c2e0cd5
MD5 e78fb8259e5b36e77cc24f7e55b5c6e0
SHA1 0a2b9d74baf6fb2a6297cbd950fe77fd5847df04
SHA512 3668575ac0dfe853e152b6023357d9bea788db8cb56ddec5e110ce08cffe5439009f23d69350722ca46f574bae306c1402899b1bfbff73a7c84827c4645bb6ff
SSDEEP 12288:reBNUbTVO86UNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:rJIUNfJ4yL/tNCJPXUQrPT
TLSH
T1BF05C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5aaa0865351968a8d8f3cb8ea4668032b3e6f2aac2a4ecb11254643a1c99d900
MD5 edf427217c0c87419dde9277cc63e821
SHA1 45285d01166040fcac226ae537db2e32cb7c8f08
SHA512 c1f840fa86e564e1c1665bee54a7ce3addae3219af8a870449bd7948f1400cc6ea3cfb3944700ff96131ed596eed3faee04fbfc00f352edc418d5f23dbf0a871
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH1:rQvGAdlCEL8c/WRNw5CQfJ4k
TLSH
T15F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9b18256f8ac763b3a69854b3537b09dc73f628a194a7b6021ec2453c554ebc35
MD5 4a91f75e443345718b0c5836168feb64
SHA1 f6206c882f75caa0768c4f8a5e9387741d5eb2ad
SHA512 b04c1f2e6a298c3f15fec3087ec19bdd8a6be42ad04b6a68cff757e78ec83b61e8b1ff556918fff6fc5d4fc7935efdd14689ff35fde998ecc67a618703461469
SSDEEP 12288:FAwSfxL/2Dc3mDLLmt0LDQewsAjbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWM:mfewsAjbfJ4yL/tNCJPXUQrPi
TLSH
T17C15E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 97ec9b5edf0b1cb267480010ebd340c58ccbaa3a23681d8c414dbcdfa8392b60
MD5 5da82191c64ca7e8568f28ae71bc89c8
SHA1 d8834650a3d9f21d96f29f25de156b7558d33a3f
SHA512 5fb7a3f23c6ad677b8e9d66555407a829157eea26f5816de28ed27b0e8aa075909ece7dcfe2b69ef1ed379dd116d17cfc560eb4c4b4e17e90bc315f4caee2ffc
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHzfJ4:pUEtQevvqc2W1cpV20I32z
TLSH
T1FC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4a21d026e39b2f75fd53a776a9dd9753472a22ed3ae8771c737291b80b103568
MD5 1ad6348dc6ec369814dd6d1c3d8e6d54
SHA1 9007fb0d0282ed24384d8199042d0346111a0cd8
SHA512 c3b2b273176d521030adbb6442031ec44760e7d04296134c00be4c45eb2de42383954a0b61c6a370fab8542da3c8f0a790be638f3d0c408dd5c8a7952e027ebe
SSDEEP 49152:ACbRquA/m2yL5zQfFiV+XenmE3/z7fJ4klKXnN:JoqtVjnmsfJ4k
TLSH
T12AD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 afa98bc37901259b08c239c45f3129cbe32abb702af7cd4a1e52441dc97f332d
MD5 7c7085e9c182ab299c8a76e867293649
SHA1 1059a0d5caf071d005c53b3c7e3508d27b3b5f95
SHA512 7f1001fa4ecf70b841a82bc59ea1f7c89773ec8109067daabb7757bdf4321193e398076dca9373db4e6437f84b91eba21dcac39e18d90766608cb1e22e784d92
SSDEEP 24576:3AhGL6IFoiwtA5l7S53MfJ4yL/tNCJPXUQrPH:3AM5Foiq5cfJ4klKXnP
TLSH
T177359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2ed741d2d14691ef2447195f0a8e3f059c4c355f6047fe6910bf38cc36c7a06e
MD5 95f3b5cdbf3726e19db5216ff4c5af22
SHA1 50d9b8e6a1113e8991822fef2e0fef95b17129df
SHA512 a4c2ad4b3b9bdc2ae562e068f7c528d4408dd721f8dce58bbf9595cf4ad43adb29d0fec3b89871a955ad8a09fdac10bc3bbd766400c7c99263867521160302d7
SSDEEP 12288:Smw5HEjsChNEBFgl0WDm+CAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTp:LwuROWHfJ4yL/tNCJPXUQrPV
TLSH
T1C005014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a872b20e8009a47459e297bd45acdfd3b8e0a49d87865d4ad707eddac906d3db
MD5 105275f8708d53caf1701f5710a90f86
SHA1 f2ccba5401dc9b2f49e9d870c240cd7256f87754
SHA512 c150d73eceb38000b10a25f60156a11731898eb70673e69f01923b0063f6975d85271c217e378d86e271f49a6c16943404327ec8a412403f0d9bceddda24dd8d
SSDEEP 12288:5yZ1IyLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:wZuKfJ4yL/tNCJPXUQrP0
TLSH
T19CE4129B32D460F9DAA782BC8AD4D101D3317C92273A43CF5A5195963FB7AC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3aa5ab079e2196adde771f6b79ef7f09865397063a78807bf4a389d0268a606f
MD5 d3e8592117108be8b2a1dd86e437ee4c
SHA1 cf22e8ef86490fe5d4f2ff2c9be083fa40af9060
SHA512 339859bd75a841b9834063f86dc2b934357973fb40303f291b9568eb73e365da94dd16ef075a83ff860cc59a71ea34912b35ab4de371e533cb0236eecb030ccd
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UF:ZQRQyi36YOcPDLvw2gAf+PN3pfJ4k
TLSH
T129667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 20ce01406bcd6586704178df00aae1b37300c85ee12862be810f9098ab370184
MD5 5f97ef781c9263aa8e4ed9d2bef3700c
SHA1 b946e66a726fc54ac3b3ae7e985c8002e8b34137
SHA512 d6b4ec2af4b23b427206aa73de71da1bf65ebf790430e6d67cfee1ffea6103485c001d6c28d15fac4e3fcef064d450cb9af027f415e631f2cdede700cdc79e51
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UK:fQRQyi36YOcPDLvw2gAf+PN3pfJ4k
TLSH
T1B2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ae4195436306e461ea589459239166b47d7d646c2a9d4315210e79c41a72641e
MD5 90a3969fc49436b44cf5066429374b5e
SHA1 8361e84515edfb547b273029dab66ef496e7128d
SHA512 4c212dad291b4dbac1e03c0e9c38d7f2b7cfba469a5772c41080043d190afc93f721641d1342b6ea9b6e2e1fc9e2abbec7bb28fb8bfa7b397911a43940eb9ed2
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0afJ4yL/tNCJPXUv:g68Qg55nhkeWu7PNU3/rfJ4klKXnw
TLSH
T106B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5c501bf38d7d859547e335a35e79744d8d68c61893743c5b0f217b4f5bdae9e7
MD5 1a20240a483909645f166c26ce58ec70
SHA1 fa982c3e10036fbf1745083bad7294c1d6ed35dd
SHA512 58bc624356105f86dea67713c27498dcfbbaf99b0f762c48998c12b1e0989ba6f28266ec9dbf9fb807b22f5c76331f70da6b9319e67b324e0efe0d216d355283
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99S:Dy5112gYy5azzVvU69nLKnhZWfJ4k
TLSH
T153167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 14ede605f4d2bf46888f1e0f6e8c3eb4bc6447d28856e668754ca40ecd5e7bb5
MD5 363ff64e02d55c2db418b667f16c3998
SHA1 4b50d1ccdd236739471240718f32765bdf0b8cf0
SHA512 a8198554aca6c9bf7a0ed5c89b444ddf370d520bc6c1f0fae2c2897dc221ef0592d9da317d50d390bfa889aa4fdd6399f2a833820f4da584432db7123dff8f0d
SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glxfJ4klKXna:zu6JmIxd2dxfJ4k
TLSH
T151D59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1043978423eef7b04d8b8efe270c0abf91c6468355572450cad3f61c5398000f
MD5 3df189d4cea99ae6494047f17a15ecd2
SHA1 ebb2a245b9ae5527a3d80389ba9e9db203a36a33
SHA512 064a2136ffedc0a8598d5f069f7d96811d3d1c143b8be78fb6d124c98e525051522f1437975a52082900fe55f58a312395b56d76e546d715f79dcba7f5ab1aea
SSDEEP 49152:z1hpsNoJpF1A67U44CwH7R4xtfJ4klKXnV:zmifPqRsfJ4k
TLSH
T14DB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6d0f4582871f3adde2d39a4cc1c38e2e7482346f57d10c782402ffdf950c86f0
MD5 a3ec0041071c4cad7383bc1d94df20db
SHA1 379a397cecd9dfb9106f188243eaa27655104078
SHA512 62ddbaff89cbdf49660937ca804a5f69a8afaf106259cd0115e71570c19de975dbdbd7a69d01bdcf307c8354a460b20464e678f1f01d2f165b8c11bce3aafb7e
SSDEEP 49152:GSuZQIY0Be2KkRVtOnks6NMHqKfJ4klKXnE:I5dKqi61KfJ4k
TLSH
T170C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1e9b67d3c4b9338248836092bbd5390432ca70cc75705bdcee82eac2f4248a88
MD5 cd27dce1ffa986ad6a73f42cc52c3d7c
SHA1 2841e76874efa75827be71896a66174349248a5d
SHA512 2d9bc0d60d74724134711cfb9ea2e36c616640fe64dfa3dacc1980a42de14149465849284b0fcc0f36e5687d4c6c6bb3867acf072a39333f88866e62fd80bc40
SSDEEP 49152:xhtSn8EApI0figjgiDn0AP5whfJ4klKXnH:gX2iWphIfJ4k
TLSH
T1AB95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9b1b5f2c93560e79e85ef344c0829bab423e75901b24b6d53bd1f2b38f3f56fd
MD5 6741a7374ccd2e4aae8980cca7482073
SHA1 fb342321511735dd870bd4abc21085c554cecc55
SHA512 b336c12557e59d943df97b56a5bb2559ca8f8cde481433bb1f3bf0cee9211301ecf6aa71d87cb56cf4ddee2854a7f53fbef026ee5e6774cb6ab59e1e7bb8c58c
SSDEEP 12288:zefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:zefJ4yL/tNCJPXUQrPx
TLSH
T1C3C423AB60C5948ADE5587F81688F001C7047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8114795ccf26996c0b2b1b57122e570aee4ce5dceae3bdbf16a369ad847e6fb5
MD5 7d8c22d8d2ba1d4ee752837cbed045f1
SHA1 4739b359e567cfcb3842169f05faaa97c6cf9470
SHA512 fd641557cc3928905724d8f078136c20addd0f92095b7d26d041d1dffaa64a6c28b3b976de5bbf5d273d8d2a9439b518fd4aaa684f6897a48e1e70fff7ac8eab
SSDEEP 12288:HffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:HffJ4yL/tNCJPXUQrPx
TLSH
T18EC423AB60D59486DE1587F81788E001C7047EC6672F62F7EF42B8827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8a206328e13ac1b3acc18c201977b5111803f375e70326461cd1e7998ce51819
MD5 cb6bb2d5ed95f51696b650eae9cd65af
SHA1 d9ed334f5d89f1ea1fd305eb72bd71a8bcef9bf9
SHA512 e897f70aee55f8c6d2a8af831f053612ca8c5f936ae4f5a8ddcd77b2d3024813ad7dec9a6838943caee322bb31ff06e012b7441340a3785e236538b01fdce923
SSDEEP 12288:/VfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:/VfJ4yL/tNCJPXUQrPx
TLSH
T1B9C423AB20C5948ADE5587F81788E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 fa61e6e37e77067a44ab3dd9b9f85b56224a2f3502253818a362924111f733b3
MD5 1cc442ecb19e803a81d02998172aa0ac
SHA1 05592761f4a214a145cfa594fabfb1babf3b1d78
SHA512 70a68ef46492be2c53faaeb06d559d64bcd916b75a78d800db3a833cac2c1de17f51e2463abb37271e649435f34b57ee2fadebe3ad91b9781434dd402b39244d
SSDEEP 12288:0VsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:pfJ4yL/tNCJPXUQrPg
TLSH
T19DD42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a371fba683cbac96c292ebb02e716c3cc2c347eb8d5a37c50e7ef508ede1129e
MD5 909784bf94e8095f7b0e340fe04ed6bc
SHA1 2f8b9e4daf323c15e681bd8ed9eb7c8c109a80a2
SHA512 a5cf3e722230dfb395f994c124bac4cb1342791f8ea47432b3990dee4a7901787b1cd5dc26e88d9be5b8c2e0899cc50392e592d49e411472a2be7b8f8088f08a
SSDEEP 12288:eEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:eEfJ4yL/tNCJPXUQrPz
TLSH
T1BAC423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6fc87382ace0a7dd55912f036174d57d9e2739252da4b7324a5b7d9929f3efbd
MD5 da6cfe90a7192073f02745f7ccf6b311
SHA1 974631df24b4c1154e62a53e65fc7dc60c671dec
SHA512 0ac21ed3249f31168c692f214c19cd602316bb68b2350e40acb0c1e50cfe6e25fea4eec0358a050906159be30833fcf7680b4f25e49f03fe1a214614cea7e110
SSDEEP 12288:TjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:TjfJ4yL/tNCJPXUQrPz
TLSH
T105C423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b47a2d6255c30813840c46001a5fb5ac2032fbf8eeb3a969edcea2c1499df76b
MD5 adbd6204751f4814f4bd42659c2183db
SHA1 577c58cd7ed5f70918425e015983a2f0816d1708
SHA512 771ee2c48b599d9092e8ce9418e4e44c2f36241df798bb2008cc3f26adca8fd329427c18e3afa2fc67d548d098b844bb6de71eb10435ea8d99647cda767936e9
SSDEEP 12288:oXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Ss:oXfJ4yL/tNCJPXUQrPr
TLSH
T19BC423AB60D5948ADE1587F81748E001C7047EC6662F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 afa1d04e3946766629f0b0d589de5260f74ac4b89524ec206f556c5b65b33372
MD5 cf20a0220dca0d602c22936d3605f97f
SHA1 11445c9d6026dcc0c71aa28ebe83a7901950b9a0
SHA512 73f6fe7cbbb5a72a91448735acbb28a0e8fa96439f3d309414c827f7850ae265340c5e68c9af0d5c2a663a7ec82845d3eb34424ba26fa8ebbc7fb431c15ee55d
SSDEEP 12288:0iZwbDzzFEoS2cPvy/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:XZM3zFVSO/fJ4yL/tNCJPXUQrPm
TLSH
T1AF0501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c3ff8d9b320c86686eafe0e854c682751f7f09cd2e5c610b5ef7d6abd154ab17
MD5 fe8211a54e4c112911de32c31d41c396
SHA1 ffed9aa2cc08992b8b4596846b3658bec19674c2
SHA512 ca965d79a2e81929b8bb0d5d062f598f9c0182e717535ae0910a7062c26b825e355f63333e26e25880c4a4edcee83c4c17ab3a3f60ab52d10af8e437d3ea69d6
SSDEEP 12288:56fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:56fJ4yL/tNCJPXUQrP8
TLSH
T1C6C423EB60D5948ADE1587F81788E001C7087EC6672F62F7EE42B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e73384d4749f2e3473ecab31a7a614389701295cafd8e805b07da02ae6155d10
MD5 b9a0d5fb410fe7dda85418cde81fec37
SHA1 be90bcb3c7adb64552daacd336571be8688239a1
SHA512 ef383be3f100e49a299be9c5c9d2c9592b50f8b18d28b45e6225e0bbb03e7e7d034e6a24e6e989c022ca0c94f458a1fd56e36f0aa9893b24e65de4b53309ae25
SSDEEP 12288:jGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:jGfJ4yL/tNCJPXUQrP8
TLSH
T1BFC423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5c279f2da4b529eae6a7ed524c05c9fcce702a1300ad0f46c14833c0a4b39374
MD5 817777bb7c7a3f350dca429ca9a7c3d1
SHA1 ebf3858fea884c454dbfe2fad262fcc96629e1e9
SHA512 9bcbe6714208fa66baec438762fc5948473dcdcfb05083c8c6951d2ae67b7af84d04c91cbcea9f6649f4ae3047106a3db31301db6dcf3003b3b4b0c4fd574542
SSDEEP 12288:hyPz5L8LfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:wzyLfJ4yL/tNCJPXUQrP6
TLSH
T1D3F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 98c778617ae0040fafb0ca4885492df2d1b38fc0284af5bf0822c7419bd9a3f2
MD5 0aadb9f14cd90679571e08913e206242
SHA1 05d506827ffc7c6529e04292a92fe55c5d951123
SHA512 05f34cb7b16920c1379b781b6082f02b6511732bc7e6040162225c8630760565e26821f0d2e3d4d43433b32aa6af9d1b32d77d3d442ec6fb4174d6dde101801e
SSDEEP 12288:k6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:k6fJ4yL/tNCJPXUQrPj
TLSH
T19EC423EB60D1948ADE5587F81788E001C7087EC6672F62E7EE43B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f64e50242dd2ff257c64dfba7b5f209a3b2cd9f3b0915ebed84743dfdb02c4c2
MD5 1552431728e7124b10acd60847a24cb1
SHA1 bb768a7913846300b07ae6e747176cf1d8b1ef9e
SHA512 0ba486015a38abd59b65cb32bc22a07faa5706e252b6f72994390bafc262a410b5b9fd152011a957731d5aa14158ca24a4fd7db82ea70452c0c4b1b050d76ada
SSDEEP 12288:e6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:e6fJ4yL/tNCJPXUQrPj
TLSH
T1D7C423EB60D1948ADE5587F81748E001C7087EC6672F62E7EE43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 999a06df99a3072a31c69eb2eff7e60dad5f69e70a8bb7ee518109ddbf59a536
MD5 534271b7cfc29f5faead493b9e790c46
SHA1 04c401c43d177fc772a4775cb2e38cf55a864c44
SHA512 79934582bb19229731b79f5d7e6b0e6bcb02102809b62dedf3e9765984d216e151a8086394fa65589adaf2f65797ef19cfc3b8de1ed7b77d954b04ac8149aef4
SSDEEP 12288:cyPz5L8LfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:FzyLfJ4yL/tNCJPXUQrPx
TLSH
T123F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f33e83ad6318123c821cf12a3dce07425c1ded96e6f546d45be2052cb70c9122
MD5 4319126d59123167728b9a07cf7f8b86
SHA1 d6d27a57f7a50ba233203a9662240c974421e4f5
SHA512 21a2a52ca459ac3f0a99a927c5114a8cc39e3daaecd85928e4ef749d94cdb365290b1f6922069f1b4bbb7d18d2ef23330b579034b38b75dc7bafe59e92a35628
SSDEEP 12288:nCd91WYoaLHF3z0z04PDvhlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTt:CT8aLl3z0zDlfJ4yL/tNCJPXUQrPZ
TLSH
T18E0501A5B39018F8EC67827EC9549502D3B27C9A0770C26F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 a761f7ab5298398a1e4d3d965e35e310c29306a4d33cdce443c1a84b851d0c58
MD5 27f8c94ee263b7a284e86ce506c831d4
SHA1 50c6f8c5c783201e28c99463cc11c75dc294fb08
SHA512 22886401c03614a6b11fd2a3fec5c08daffc5194b499978b0b4bd986d02512d8b85a78da36a628dcae2cab1e47df8f3ec63f574fb6d4a4d8aafb5205fadcf17b
SSDEEP 12288:pi4e7+RdTfgwCHKy7GLbbdIv4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGM:p3rd9CHKy7GZJfJ4yL/tNCJPXUQrP/
TLSH
T10E25CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 00e8380727de5bc83ce668d7acd7abf575bdd52729baea27c831876561523057
MD5 e10902b44798131a05e0488c411c4875
SHA1 17b34952459773d2fa358919db2f579b7f76f8ad
SHA512 8ba28840334f52a86a7a684f253b5cb1a0a98734272c978c36f52566cb97940a198fb91f1c14c349c2ada4e515d282e2cb6ce29eef8e519eefb924ad5a562a5c
SSDEEP 12288:g1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:g1fJ4yL/tNCJPXUQrPX
TLSH
T1E4C423AB60D5948ADE1587F81688E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b6aeb7828b07739111d4b850de545fe8226e81efbb4c266d32de0ae144c8e632
MD5 b068a9a49c74d6e1a939698d2cb7f6e0
SHA1 4cc77fb1a948b8bc4a43aa957719d84bcd325ab9
SHA512 5555e3e3ee2ce7a14bcc38d589f88ac70ca5d36ab4f533e3f648f59a9e32313e4f88de4f5fd00fe3c884454dd10ee6be0b9a0d34733cf7d232665e4705074d64
SSDEEP 12288:ArfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:ArfJ4yL/tNCJPXUQrPT
TLSH
T160C423EB60D1949ADE1587F81688E001C7047EC6662F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c3f5ee95d7dbeedf5efcf25e42e69329814abebfb119f0503e1b50c5b11024ee
MD5 5f2c72ba310b50e940b414f7ddf1a455
SHA1 2f253635a21fb44b3b212bd3d8a1d58d21205eb0
SHA512 5ebff336f98d5778377f075c9645ea1f9e4d9d9f07639225966865802a4ed3047ccfd52548fde0ed5b10abd9826d050005605d37695a9ba7e40df9a63d26fed9
SSDEEP 12288:z4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:z4fJ4yL/tNCJPXUQrPT
TLSH
T130C423EB60D5948ADE1587F81788E001C7047EC6672F62E7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 61124cb6ca3ac5b4be6a6e6fc9548b7d1849813c561758b71b5de0084acdfdac
MD5 6da59c078ac479f74b75b1c83a171a77
SHA1 fd9ba0e95e2ec8566fed83a28e2a046f98bc444f
SHA512 2154450862c3d2000cd0182b31ae0ba4cf61d9b4523f30e7e301cfab4f387cbc7d4a5c934700398cf8a69fa4fa4be60a6bdd81f88d1ebec03e1abef9e3b3a324
SSDEEP 12288:UpsfKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:FKfJ4yL/tNCJPXUQrP/
TLSH
T1F7E4015AD29441D8C46E92B8CB449201F3237CA593E2D3CB97C0F87E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c243f73191c8fdccb4a38a2ef53654fa2962cef27f295b7cc8daa7e7a547fd71
MD5 0121c9e4ea84389a677e1795ce713b39
SHA1 73b304a90cda324fcf828cd4472bb274c3b24857
SHA512 960e9a6658d3c7169d15e57840651adef966593ddfef28f6d4bef30e74d0ac2ac39e3d95afd4d6b3dc9168fdba9ae7f07316e9ba1133e8718c12d0fc89952c49
SSDEEP 12288:QZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:QZfJ4yL/tNCJPXUQrPq
TLSH
T19ED423A761D8D44ADE7687F81648E000D3097ED56B2BA2E7EE42B4853FFC9161DAC313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a94a99e5cdd17e59afdf9be1de5670072b080423c836c4bd87204e7eaf00318b
MD5 a6da6768e627a0952d500476d8cbe887
SHA1 36b1f962c4a414b0eb6ba2ce8ee0c4603c796524
SHA512 436e3c5d24988d2cbeb9f13360305a4229876a548bca01cd5812361191b3226c53ee315a6854655a846397e3db30049d3ea2bde9d6a4e94dc61c0762a0686e1f
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQvfJ4klKXnP:5a0hNYG4JwQfJ4k
TLSH
T180859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 486df74ffeefb84f678788ce488cf7bb8d661018791994e69ed89de74c426018
MD5 2c2d6461ee693f2e1cb7b1b4c34e79ae
SHA1 6174b6958f95114f65f9ef257b933a985097bb79
SHA512 2d60a413cd22600c227b396b04afa1383bd191f0bf9e223a1ea5680f9c3471c6f5dd9446bae8b110ba607cf15795a8e7800bc1177d0c415655e25726723e2bb6
SSDEEP 12288:ohbHjfXMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:ohbHjPMfJ4yL/tNCJPXUQrPQ
TLSH
T19CE402BE22AC20D9E571D2BC4684D106C331BC951726A3EF67C291792F7BED51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 13a412f7b457b88e4d2a26f3ad683dd6d9463e4b174167215fe2a02eefecb56f
MD5 f14d1a9613ec40dff26f9d72cc28fc08
SHA1 da8833c68ea100b923cb86cd3d6a83d2c7e30fd8
SHA512 2cce02a748a52aab3909219f2597000dc2bc41f0afc572aeb00389cbc4b45d618d245394217f70aa6242647374f8b6d2d369f2f620be49c7355efd74176f7de2
SSDEEP 24576:13YgnJcRTk4yti+R5dBR/sfJ4yL/tNCJPXUQrPH:1IgnaTk46pBR/sfJ4klKXnf
TLSH
T1A645B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 e4e2d8d6e5162196f9232e857d4b2fcd00e3dc53887633e264ee37e62768e0cd
MD5 0764d89e28b6853ab6d121cad38d7bda
SHA1 c225359cefed31a6d5d068c41e12aa98acf7a0df
SHA512 52b2f7c71d366616f901508df785930dd8f4bf11000e2caa9c592ac03fa6159eb30e24c9c71294797830e605fdb4bffc6d666214cc52471a2aedf626d7dbedfd
SSDEEP 12288:E9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:E9fJ4yL/tNCJPXUQrPB
TLSH
T146C423AB6084948ADE6587F81A48E001D3047FC5272F62F7ED82B4857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 be901f3f4efa2f7fdc2d3ef026665469a9ac34868c0dbeb49b72fe749084c8f8
MD5 ef7999bf56adb5c77397b3177f37bbe0
SHA1 b2632be5bf256258567d04934456c5513cbb5524
SHA512 0a0d0cf75396b740e0940e95ef80ce384473d75b28eac399e97d03755c7ece1c5ad6284fe889e4e52a8a6fd035037d16c2070d0807099f6bfbd6e0387bc6ada7
SSDEEP 12288:SObIA4LWOsvAYFTKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:DAL3UTKfJ4yL/tNCJPXUQrP2
TLSH
T15F25F155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 76f76d31d30350e688641d12f316dd4c02299a45205388b3b0ffa82ba0f9c558
MD5 ca7fcab5811a4cc958c5edaf80bee830
SHA1 fc7b976ed9120bed52223230dbb7f2a70f3403da
SHA512 3b689ef58b3826b6a88e755eb869abaa4df7df4d1a1944d3e335a424d4387506a48f7534a67d1030be5f4c415e74f376150da97c2e7f2b2644e151710a4f78d1
SSDEEP 12288:SpFtvO+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:mO+fJ4yL/tNCJPXUQrP8
TLSH
T102E4026A32DC10E5D576927C4A85D209D331BCA6172753EF46C080AE2FF7EE86C39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 60cc27b525d755af19e4f00968e23028e47786525152bacd3679b525d00a54ad
MD5 c42fd4855d5f90a68cdac5c5de582331
SHA1 ed717f852737a50848d9c78ff7ee8fa76f086c89
SHA512 b76f144d5026108eda3fe452ae1563a4138d5dec2d0816efd09dfb828e5db02201c9955cc4a6751d69e02fa4544d8dcf94c28803034b22b72909d10600025167
SSDEEP 24576:K7NM9YqZqmWMUkPjZM48Mv6bEhspfJ4yL/tNCJPXUQrPI:K7cBWMpPjN8DbEhEfJ4klKXnA
TLSH
T1F465AE2E6BEC81E5D477D13DC9A28205F2B2B4611B318ADB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 252185fcef3d233fd96d0568ed8c5d674b910a65c68da48456f0ba80013c29bd
MD5 3a12400abf46041890b18c92c1687238
SHA1 32dacff483075b22ef2276ebed5a35cdb1b552ff
SHA512 82212a150e559a8fe1450a994f4c0ec68a6877da6a77fca9f8d9637ec85dce2a297bb9405cfb5b13cf77b9ee2060829f325f322e15898507583f547ed79de789
SSDEEP 24576:NW6BApg2YuyuNDYTabvcdvNYf8km17fJ4yL/tNCJPXUQrPH:NF2YuHNETovAvNYf8kmJfJ4klKXnP
TLSH
T138858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8895c199695d3be432562f0adbffcc103794556f106af7edad524b90c1361f8d
MD5 f325a05ba3b1adfb321615f709dec8ed
SHA1 95f8725caf5cae547ac2fc8e86e1269df22a1e3a
SHA512 31e09312658db3e03bac1aaad722b69b861f2e7f2e9738db819cb966643a75e0e9a89b147edc2a008ace9333e06c22027ade61cd108227cc7ec666cea8283c8a
SSDEEP 24576:RAFs06+Omlf8NXEbToifJ4yL/tNCJPXUQrPi:mFs060loXuPfJ4klKXnK
TLSH
T18565AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b9f84fa46c8c2ab5c13c6efcbe720b37c3f1b7a454492205d575c3fe5c49114c
MD5 6ceb2757cdeeddecefd8fc5092ecd273
SHA1 b6fc451a3cd43bfce985e3b7933617694b815240
SHA512 161749b76292aca5df3379db62e9dead7ace75afa2116094618df0e7a7e4714484ea0990ca1a65596795e42ec79e7c68d9080523c4b8a2e5a434f7d9bb3c9bdd
SSDEEP 12288:jCJnJ5D3VkrDzxJfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:+JnJ5D3WXPfJ4yL/tNCJPXUQrPG
TLSH
T12C15D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F16EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 aa89e767a3c840addd06d8691fab3ece9dfc694c8ada4149520b7934703722a5
MD5 172a306a714a261e0cf4c62e47fe941c
SHA1 8db8c15c038d476a0634e8a59b0abbad6f20027b
SHA512 ef14508bd8b2f9e78837ae6b9410ed16c823dca3fbf3645946ee1ca560bf9dd2c4f287dd57ae6322b27263eee4017d8acf74a65088d4d40d3a0f9330c9d7d33c
SSDEEP 24576:SEPghm6/7IIXdwcXrif7qQncjlP65i3VusfJ4yL/tNCJPXUQrPn:lg06DIKdwc+eQnSt65aVVfJ4klKXnv
TLSH
T141955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5e14b498100e74c06a3560704c247134a2383f401e5878a2b8a4e9c97646df55
MD5 0c5ec51a84ec5f050b4b8a2226aa5db6
SHA1 9839de615d288afa65361b28d81297b631360cc3
SHA512 243745b48b88d3818235062d7cdf534df049ef1bf8daa79ff0c3e9afce1c1e40071a232cc601de7089f72e70991e81c3c5752efc4ecfd976e3b3bdffc48c6238
SSDEEP 12288:IEP3RnTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:jnTfJ4yL/tNCJPXUQrPx
TLSH
T1BFE412AE229CA0D9D52691BC4680C101C331F4A12B2763FF5AD1D17E5FBBAEA1D3CB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 b1336f7db63db47c4b9294161600011d5de101b8707567887175b6c029fdc724
MD5 ad9c081412d312707a4828c20270b76e
SHA1 21f2d3e59ef765ba2e27c7f6b5bceb3fd9d717ee
SHA512 8fc34580ca042687647a049126b4aa97e7ab1c3c78c15ab82e2680c11a684e33f296a7a508b2822a4f76755a49883311b904c6e059ee74c028b3f34afd78057a
SSDEEP 12288:ijkyUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:iIyUfJ4yL/tNCJPXUQrP6
TLSH
T14AF4224A23D4A085DAB647BC4A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 e83b4f9054bccfc026d885de88d1c424719811a8b818fcc7a11f9b57f1b93514
MD5 6c52fcd7a645fac30fe66f0b46d53472
SHA1 e90a500a58c0be2f2234a84f3d5a7365b644bac7
SHA512 6ae6d752ded270e1d18b699d18817144cdc3b0c6d7c41c408f362c8a5d31b18b6a907b2cc33a93fb50529989313aa28cf275536675eefbd63f4b15ef2ce0eea1
SSDEEP 12288:pyufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:YufJ4yL/tNCJPXUQrPX
TLSH
T197D423AF2095A089DE2687FC1648E000C3147ED5272B62FB9DC2F4A17FFD99615BC792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c5596776aca4c5474d4ac11d937bf8b473338e831669695dce57081ce1661204
MD5 7656aeed873fff1965e6194bea27de90
SHA1 fcc3f9ce53fb898b33516b0d38bb68fe384b7256
SHA512 c12e0c43cdd731dde397754dfb8d0f7f1fb7163f451a87fdeec063d8209c54879789abfc7333368db7e296b25a926efd9dac54a86c6ce74fae50bd422ac24b90
SSDEEP 24576:0Q9MxZKdcz9dw3BfJ4yL/tNCJPXUQrPK:0VKZBfJ4klKXny
TLSH
T177558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 1ddbd28f23697571aaa39e8dc278506f05c1c7bb78894fbec92c0e3d1cd3e070
MD5 d25ff2092bb7e2828939ee1c3f071ce0
SHA1 e2072040539e556f67fc3afb3f01c7357ff2da78
SHA512 ec63ac184dc4cd219f65a3c351f01d3da89d48f7562a6be7b831923b3d5cc17c2345b82b286239fa7ccb971169acd5fde22e00d9143e44276fe467cb519dbec5
SSDEEP 12288:VyoKo2JRple9pIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:VyocDApIfJ4yL/tNCJPXUQrPO
TLSH
T1BAF4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a97dbc4b5d9735cfbb426c8206c4c141ae64e40a3c4b5679c64d74d1bf3fa81c
MD5 43c3f90aa74c71b4f3e8dc3ec0846258
SHA1 354eb9344ab5f0f6614c0dd58f89ec0993127bdd
SHA512 e910eb5b5c652314e9f3fa809bb4ac232fa565f5e8d87a9a373da67db43f28165f40a1b6b213e8cf8568ffb3544acc37ce910ffe689f1ac5136f8b37dde61a0b
SSDEEP 49152:KWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKIfJ4klKXnC:M0zuNIKfJ4k
TLSH
T1D0A57B3DA2F800A8D9AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7b49bd6f6335e4abfeb12c5252176ff3e6ae0b1818dbb211c83f15bbbbcfca50
MD5 03506d915b45aac81d9492097154bd44
SHA1 db89dbb5fa2c6b9f1295221213e7717e3a8a6790
SHA512 0a5a87cc643cc9c6fa32a7b7820e0e061dbf841d87c5257cbd8f8888a0d4248b23c379c4dc458a005b7839cdcaf11e53b6ccdca585821436bd693eff3b42be73
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYzjMqbTfJ4yL/tNCJPXUQrPt:3TDxR+N5YzTBjMmfJ4klKXnF
TLSH
T16D55B02EA7F855E9D17E85789A23C502FB727861033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1280-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1280-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1280-232-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1364-415-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-452-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-418-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-429-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-431-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-432-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-433-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-425-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-434-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-435-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-428-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-436-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-419-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-416-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-437-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-421-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-414-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-417-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-438-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-439-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-427-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-440-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-441-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-442-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-443-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-426-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-424-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-423-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-444-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-445-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-446-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-447-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-420-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-448-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-449-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-450-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-451-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-422-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-453-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-454-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1364-455-0x000001E721BB0000-0x000001E721BC0000-memory.dmp

Download

memory/1480-0-0x0000000003110000-0x0000000003170000-memory.dmp

Download

memory/1480-9-0x0000000003110000-0x0000000003170000-memory.dmp

Download

memory/1480-28-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/1480-8-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/1572-263-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1572-264-0x0000000000600000-0x0000000000667000-memory.dmp

Download

memory/1572-269-0x0000000000600000-0x0000000000667000-memory.dmp

Download

memory/1572-413-0x00000000008A0000-0x000000000097C000-memory.dmp

Download

memory/1572-321-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2024-326-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2024-481-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2380-343-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2380-402-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2380-484-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2380-408-0x000000000C930000-0x000000000C938000-memory.dmp

Download

memory/2380-359-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2380-331-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3076-29-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3076-25-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3076-19-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3076-27-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3264-410-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3264-295-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3264-302-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3264-296-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3516-245-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3516-312-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3912-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3912-216-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3924-322-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3924-480-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4144-407-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4144-290-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4144-284-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4144-283-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4248-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4248-34-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4248-231-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4248-43-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4352-469-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4352-318-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4584-306-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4584-411-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/5180-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5180-412-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5180-330-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5288-325-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5288-273-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5292-75-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5292-88-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5292-69-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5332-249-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5332-259-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5332-253-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5332-317-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5388-242-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5388-240-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5392-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5392-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5532-87-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5532-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5532-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5532-233-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5532-77-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5720-280-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5720-404-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5892-430-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5892-313-0x0000000140000000-0x0000000140147000-memory.dmp

Download