f0250c9674f059526d5f93f07d4e504a54d2b51b6f45d848d2971b9ed0d98964

Analysis

max time kernel
150s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
Size 2.7MB
Sample260511-e4xd5abt3y
SHA256 f0250c9674f059526d5f93f07d4e504a54d2b51b6f45d848d2971b9ed0d98964
MD5 d8162e4f32ab4ecda1a4d499b48efb4a
SHA1 c73a0f73baf02eb630c6ec784938573d70a5c396
SHA512 541c0cd87dfa543d176a0bf06de4ca8c33b00f135020c456d9e6bcd86eaa7bce63e2dcadf1bc2b90926b5046e566515100d511cff1c3807911575b96f1dcfeb4
SSDEEP 49152:fumKCy6ZsUmbl5m6BSDf5FA330fsUdp9W4LUmO0CGLfJ4klKXnd:BJjB2mLfJ4k
TLSH
T14AD5AE17F29A10E8D05ED1B8CB598232EAB17C490B25B5EF0790B6652F37EE45B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1848	alg.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
5884	fxssvc.exe
2508	elevation_service.exe
3588	elevation_service.exe
3540	maintenanceservice.exe
3964	OSE.EXE
1036	msdtc.exe
1592	PerceptionSimulationService.exe
2948	perfhost.exe
5148	locator.exe
2456	SensorDataService.exe
240	snmptrap.exe
5700	spectrum.exe
1288	ssh-agent.exe
2096	TieringEngineService.exe
1240	AgentService.exe
5556	vds.exe
2644	vssvc.exe
5736	wbengine.exe
1356	WmiApSrv.exe
5420	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\76c9b7c4b955e89e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_165671\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_165671\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001634cb18ffe0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8918417ffe0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5281d18ffe0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c7caf17ffe0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007917eb17ffe0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049d2c818ffe0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008290a317ffe0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037d04117ffe0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe
2508	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4984	2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
Token: SeAuditPrivilege	5884	fxssvc.exe
Token: SeDebugPrivilege	3528	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2508	elevation_service.exe
Token: SeRestorePrivilege	2096	TieringEngineService.exe
Token: SeManageVolumePrivilege	2096	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1240	AgentService.exe
Token: SeBackupPrivilege	2644	vssvc.exe
Token: SeRestorePrivilege	2644	vssvc.exe
Token: SeAuditPrivilege	2644	vssvc.exe
Token: SeBackupPrivilege	5736	wbengine.exe
Token: SeRestorePrivilege	5736	wbengine.exe
Token: SeSecurityPrivilege	5736	wbengine.exe
Token: 33	5420	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5420	SearchIndexer.exe
Token: SeDebugPrivilege	2508	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 5160	5420	SearchIndexer.exe	108
PID 5420 wrote to memory of 3388	5420	SearchIndexer.exe	109
PID 5420 wrote to memory of 2364	5420	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_d8162e4f32ab4ecda1a4d499b48efb4a_cobalt-strike_icedid_njrat_ryuk_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1848

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1048

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3964

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1592

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2456

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5544

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1356

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5160
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2872 2864 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3388
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2940 2936 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 51d64dd5d2ffed3e02c4da8b89ae26d896994d758e5fd0af9807b35b5176b3a7
MD5 c93af0cab2a2dff98bed057d3c1cd090
SHA1 4a0731777630eca0a9f650741a9ea7276e9db696
SHA512 353d28e04460854ea634f5c912e8c04c397e875b637450179d702758b2626492d73834c1b23f64fb51f24864865a1f3c0705f7f4da8c27f261f6c423552f84ea
SSDEEP 49152:Sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrfJ4klKXnq:03q6mjB0fJ4k
TLSH
T1AED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 250942ff3654c54e79703772e426d38ccb51614b68bcda1be642f8b1dbd068fe
MD5 a5ddc2b795e54156a65df8aec1eb9824
SHA1 23942017d0f63edc3140b1bcee8dad5e7a8cf670
SHA512 e7057df24ef69e06b33f215067ce2879b0724cf6b7acb63393f484d1da932e4ee2c1d0c903876575ecfb267cee0d0726640069ab4e241f54a02eaa51905a248a
SSDEEP 12288:X1XLsswWkxy2lRq2czAgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:FXYfDtczAgfJ4yL/tNCJPXUQrPE
TLSH
T1D405F12973D008F9ED67827CC9A1C101EB32BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7ec9fd58e67039f3212135100fa9439072f713e1ca41b9907d0084d57ba847da
MD5 e827089c98dea8aedda10f5f302cb882
SHA1 1b5c09697d9ff5a08d7f7dc3d467b17a73e6de74
SHA512 889c2bd3d7667a929c20eabc49640a0336f2231d8dbe04a4d8753993e299cdd2bee62120f915ba588a70142b2e7491c1158ba94b871b3bb3540020c5b895c452
SSDEEP 24576:h0Le5ji0hmxhrMDfJ4yL/tNCJPXUQrPq:hPji0AzifJ4klKXny
TLSH
T19535AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a275551f8798c2843a40f89d5f564bbcc0073c22f22357a3c40f859b461dd67f
MD5 6d153b7a5315e2148f6f91dc451ef4ad
SHA1 d8107854d85077d97a77dda8eebbcfc9e92c64eb
SHA512 3638d2eee2f2b23f1e758a761a987b89576ff55b875a6450cce726ff02767918e1c235f05eaedc665573016704bf691714ceab8e50fc64262371a031c1729e2a
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyuJfJ4yL/tNCJPXUQrPZ:j/ezSC6vUzPv+HjyefJ4klKXnR
TLSH
T19E756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0b780f4a68643b6a857369109d5f9b2d428027b1ff6f926441790f76f171278a
MD5 5c32c7da2d57d7d235d6fd6c999c95ca
SHA1 5bf9197da9362cd0fc98334a985d7cc02de440aa
SHA512 d4e3f5a4d357b02c0e402be71b21f80f223bc7af5889786206b804efc7e6f3fa45b80468793a990afe7d962b1fb27a096e958b35eaaa1fdda854e322aa5d7e4d
SSDEEP 24576:ZVbqPb88hv/l+BkfJ4yL/tNCJPXUQrPs:ZVO88hXl+CfJ4klKXn0
TLSH
T190559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 64496ad7247399a8b7a8d1e52f89cdd379e1802109423ec4ddfdff2d61d26ce6
MD5 cccfd8c063cfd7496cae6397667e843b
SHA1 1fdace32529bc14976ad9f0e31166af2cc058ca6
SHA512 5b82ea0f20976c8b046831bc88a8a847333fc0803f9731229ffcc74cc11e4276fa0304e1a9381a84da53e819bb9aa628b404088478532b852068229233bee623
SSDEEP 12288:xGHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:xGHfJ4yL/tNCJPXUQrPO
TLSH
T1B2C423E751909086DF6687F82A8CF001C704BEC5562FA2E6DE82BC857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 2f34a75de4384553a69e62c8ff5dd435b0a6dba3dc487ced972ae34de0be5aad
MD5 525180ea4139f875bc0fd8699a24f54e
SHA1 c2723d5062d0930fddbea6783e54ffb2bf6da6da
SHA512 69f55b5c303fc9a5d03440a73a862e267dd60dfea6367ebfef579462452bd40510230be26e741862e0acc5db9876d173af52d8de2e2f431d3c17db9bdcb56bd1
SSDEEP 12288:geBNUbTVO86UcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:gJIUcfJ4yL/tNCJPXUQrPd
TLSH
T13D05C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7a2355e12e1f7de74e83c4dfc7b2807e799264636af6eddfec76476b239438fd
MD5 b67eea0d0051078b94adbd766b7f9f41
SHA1 5bbd4a6166ae7058f076546176c20126fa321352
SHA512 7e17431c90aa47c5b2b2494980268247eb43eaf0e901e0455e31be7a745c991dbc4eb053892a83ba39ccbc7fc2bd260d156f6f9af9a7b9f4635503c0d7494a81
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THd:PQvGAdlCEL8c/WRNw5C5fJ4k
TLSH
T141267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ef27842ff017be025c5b3e49cad845054fa4ff2988083501ff3674afe35c95f9
MD5 2e760693cd7e1a537fcf276c761c8154
SHA1 fec1cb174ef53d4db61445a572f3f0cf018fbc50
SHA512 518eebcbb005fdc864d23eadea4bdadcabd6a44da33ab9184660b8e377add14663cbc1429bf9f01569e2e82729fc4a4d7cfe9d64fee44ec5f76aa6051e326085
SSDEEP 12288:cAwSfxL/2Dc3mDLLmt0LDQewsAjSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWV:BfewsAjSfJ4yL/tNCJPXUQrPP
TLSH
T14D15E031FA74E036C77F0DB51B25D306552C7A604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 67e19707047b6f34461d7d0c22b2d076e16d142204966eafbcb666d888c1cda9
MD5 b4a8b428a3a9488bbc2f7579f0fafb08
SHA1 977b7ff7512c95de0515dfa9600575ed4a449dea
SHA512 c137e2f73ad8b5ae05de5e891b5cabad9c9a39ffeeb078b08548bcd0ecabfd863697cf4ee2b0ccc31c1e8a4d8b4f9a4c21c05f539d2bec4caa0e44abf70bac75
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH6fJ4:yUEtQevvqc2W1cpV20I326
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8eca7e4ae3872c0c38169f4b57cc5606624a7ee8ad64e2457c6a17a4a12e63ca
MD5 149363ea883bea67367e2a15a9f95dbc
SHA1 57e26f807d89eae1ce5059788b8a7b97f81736e9
SHA512 717bdefc4fbdad696c30c77c04bf2586313b65fd50378c3b306b8413d393cc5d82a10aea3a0784f9db4b0fac69448b8ace1317ef5d01fb69a9727a51dc25a081
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zyfJ4klKXnj:woqtVjnmVfJ4k
TLSH
T143D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d62793e4746dbbebc87bae933c36d779cfaf8a99d2dd2c05dd8fb53830e53ea3
MD5 dc95b1bf631a89e2ad25fdecf3b469a7
SHA1 93c152d852de63c434ef034b7bc410397becc728
SHA512 87606c9b74177da7018711189b21e57eef74dd344920cd74e06b2bca7f00bb63b24129b8d7c4069ae38ca4a10e49cd590e7a29575f652f6751458d06b247aa83
SSDEEP 24576:qAhGL6IFoiwtA5l7S531fJ4yL/tNCJPXUQrP5:qAM5Foiq5FfJ4klKXnh
TLSH
T154359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 fedffdd545c4fad1339d08968d73f4c6347b240df9de36a65840e0945a13ccf5
MD5 582a8ad6c74b54fa316a8ab065da283b
SHA1 387418a2912f3ec1b6aaa691cc5503183b7fb942
SHA512 19362e8672538babf160aeee0ec9af728df0951eece74924dbe4733f543d78813beb7e4a98c771a903093fc8cffe7ecf213a87c366028dac7966a16a96d713b0
SSDEEP 12288:Omw5HEjsChNEBFgl0WDm+CpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT0:HwuROW+fJ4yL/tNCJPXUQrPg
TLSH
T11F05014A32E41CF9E96782388687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 51e4da3f8460540bff24de34dbb3def577e0b14a16500e38394c08f3f1c0e510
MD5 53387a98c4d9049cef01965997f0ac94
SHA1 25deb90e814449253efbc4a9e637f20e53bd5172
SHA512 ce19a8629bd303999c26d7aa0e4f5abffa605f6bbef0cc203e6a55950cfdbcd85a848c33d019b4a55c3446263cbb2a1d14aa3e7b9d5f79cd3cedf176063f4644
SSDEEP 12288:EyZ1IyCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:5ZubfJ4yL/tNCJPXUQrP1
TLSH
T1E1E4129B32D460F9DAA782BC89D4D101D3217CD2273A83CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cd752a6883dc091ebc4718c3a8fd020776bd57fff8a0d2fb1326c90c700f6db2
MD5 9bae55f40924969feb7a2687a4b9b274
SHA1 9f9793370978dca0a19c606ede92a9afa03705f5
SHA512 25a72f56110f407d977c9a2c0be2060131f5dcc762b0e1b7e3c5c6ecfeb84e22dfc85b38d5ecc24b00efd3fb22310d1fd4bbd9290a60d97f668a5d127394c3b6
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uj:GQRQyi36YOcPDLvw2gAf+PN3YfJ4k
TLSH
T1A5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9d9fcb372c859e5a9bd0ddeb7828e7932c1d944a7f9fe40c16b4abc076e2972a
MD5 2768045fb4db1243e7998c6591896727
SHA1 224685692bae0105505fd22006ccb0b296681f9e
SHA512 2a7b608f1c8c541e375b2dce7894f43a0cfae4a798e7e9e8f31ff9d761da82aad375089bd3a5161d250d2db2d9cebdd24ae615de666b24eb2cfac8f424ec1830
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U8:mQRQyi36YOcPDLvw2gAf+PN3YfJ4k
TLSH
T178667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cc571fd441b0b2f1f59f371f3c87664e0295cd946c35cbee12784bb7a577a30e
MD5 fe38392a71637d37e186e4a15d52f606
SHA1 8bd216acbd68ce313fb8d42405e13ff120509f77
SHA512 999aee8b26a2c944b76acd19edf74d9f9fe2abab8a1e3c31308ca4a54553d6662bdf91d313959ac06630b4358289a16de64fe37283239f38e6dc38b4a9c0dcd5
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0rfJ4yL/tNCJPXU1:X68Qg55nhkeWu7PNU3/ifJ4klKXnm
TLSH
T11DB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 22c0a61aef4281342ba0c694fbc19ff1f1f36a5834ccec855b841c6066ccd6d0
MD5 73300dd9cc066f77292746df115c80bd
SHA1 43a65bf68e6b48e2058b32031b1135580a0910a6
SHA512 038578f15add71c943070bb23cf0d2610ea8f9be432c190b4c05c1dc5aa6ceff1a5c3d423595101a91bf25af58b625229ba5cb094b29b1c41177d4397bf0a3fe
SSDEEP 49152:w3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99O:9y5112gYy5azzVvU69nLKnhZHfJ4k
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 54fdab726cd023881db308db60615dd09ed03aa24e9365b07680198c074d4cae
MD5 ef23d5a674be9858cd72a45ba2c8ace8
SHA1 8d6f769a09f5fbcfaf0b03f1b47aa7077c9c5975
SHA512 b77f869b1174a89a397a0b9165891842ab317d46da3e41ddbd142844157824eba2444bdc0cf63f585bb8b608f133f953c973b8b34c77dba7cdbf3aad995f8ad9
SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glNfJ4klKXn0:zu6JmIxd2dNfJ4k
TLSH
T135D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d4361b6fbe8d03e959eff336edc568a154134ef5ac36eaebdb97022ed4fff9c9
MD5 2727d7eb199164c9c869143d2817dd34
SHA1 d7e9981e82ecbd09c7fb868533624726acb9dfdb
SHA512 996afa4058b1556aef0dbbda882456ff3d91bbdb81afa6eeb38db3bfaa81a978974ffcaa16417444675c99d6f8f69a9aa1aa1acf9dd4fbf15d6d414f39dd9605
SSDEEP 49152:s1hpsNoJpF1A67U44CwH7R4x8fJ4klKXnX:smifPqRVfJ4k
TLSH
T1EBB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 be7118fbbeb7769d1c6b698788a2d96af32a172cea3424739483705d8df474c2
MD5 84d1057372ce261953384aae97bdb07c
SHA1 76878d6a36301a0697a5ee8e8549f70e48f5f1e1
SHA512 7359d203a3569809515545a87ff919a81bd1dd330625ec67e99736ddae3146272d5701a146061bf4c146bfaa57ed49c877a9ac1921482f772d8bb74c3e51b317
SSDEEP 49152:XSuZQIY0Be2KkRVtOnks6NMHqbfJ4klKXnJ:N5dKqi61bfJ4k
TLSH
T1FCC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 23a5d77cbf58bd11723674280a4e5643c68e9a4a58ff6451c1d77a0a8b11a8a9
MD5 a6971711d2082be451d80f19d2eb2bb5
SHA1 e8d15d68b4e210f8504730dfc4be9fc6bd7b35a8
SHA512 17a9d0c3e23a8e4de67b76f55d326761291405c449a0c23eafe02bfd088e9c0b7b0186670c4f1bfd9cb26deaf0633e9a302440bad3006a43eed30daa21bae5d0
SSDEEP 49152:ehtSn8EApI0figjgiDn0AP5wgfJ4klKXnl:/X2iWphhfJ4k
TLSH
T11595BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 002f3441880416343240c1c2f9a96567d7458307eb7e77f528d5d1a09b46d524
MD5 61110a1cc03cb60a11535aa318b812c1
SHA1 bf35dbdd0a526f178a50493460dcf3bcbdd16f2b
SHA512 812545435c70468d9e7859d5d5df7971cf4e08718cd9c2482e0bdb604663c6ae703ff754e9234948954b6aec135caffaf6fced4e782ba9d2bc79bd815fa0709d
SSDEEP 12288:+/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:+/fJ4yL/tNCJPXUQrPL
TLSH
T16BC423AB60D5948ADE1587F81A88F001C7047EC6672F62F7EF82B4417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9456e55a9b45bac976e501ddb5abd888ab81234c66887d6adcb078bf6c884aac
MD5 441059397d3dfc59036439a753a13a5a
SHA1 96d0c860165e1c9eaf012f739eacf542ac739642
SHA512 f4c10e3b778aeb6672afbe24405ecbef5ccee51d0331aeaeaafa3938c610740cf8ff3ed93e7b45d6e9b39272b33ce5c202f4b23101fe3c41a4025af8458d722c
SSDEEP 12288:wmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:wmfJ4yL/tNCJPXUQrPL
TLSH
T1DAC423AB60D5948ADE1587F81648F001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d46866d038fd64edc28ee0ec328299a2876c4f9491f78215d46adb30ba2f8914
MD5 4ae7e1605daa2089f180dc25dc8aa66a
SHA1 90c27a2ef8e0e65735402b35b797a05ff0156a3c
SHA512 2285523b4d3c32868b1363c8306c91764441524eeaa6f0f6cf0955d20d2b94f332ac500aaae1c4582b86e4e65dcb1d6c9868629d2213c4a802240f20ddbcb362
SSDEEP 12288:+0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:+0fJ4yL/tNCJPXUQrPL
TLSH
T10DC423AB60D5948ADE5587F81A48E000C7047EC6672F62E7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1cb7355e330b77d726a1176f73f97f36f94c1a95a0957d00f75e31b9fa8f7e75
MD5 7bd42b970e1428af2488117951d80adb
SHA1 4906e9b652602f1245f88e519e1bed00fe260661
SHA512 66776f1fd7af2d493dec1a8ab64b5d2f5f98acd2f6163a98897c7ccf57919e2ff6f82de3c91cfdc5151ff7dcd92675540a73ed64cdbf97ea70262e9fb8bbad5c
SSDEEP 12288:6VVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:mfJ4yL/tNCJPXUQrP4
TLSH
T154D4239721D580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659296C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f15ecac7f92f04416a3429239a47c08b8f9e743f46f80ba3c9c9cb84174757d3
MD5 fab785a87e57a537a16b7686b2d552f7
SHA1 53c7a2976f602fc59078c7cd4995b74c24c6e9b1
SHA512 cc1ef5c3ed68b15fe0f31ab38e373567a870b2a496592a6846fcbf7321f4cd1859301590cdc844e9e57ff3f3aaa500cc3453b4a6c62c2013164267a6ab6190d6
SSDEEP 12288:+9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:+9fJ4yL/tNCJPXUQrPa
TLSH
T118C423AB60D5948ADE1587F81A88E001C7047EC6772F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c482f96b330a3f192d41df9234ccdb404f346e28cc18f8c41c57ce285d4fc317
MD5 e1462e676f7eddcfe77e0e525e7e02ca
SHA1 0db28900ac7c360e0456ca8d9add42c815d75e5a
SHA512 b1f19023ffabd2157c2b1eb2349ac0e216d73bf48120f1fa7015d7be0740cfdb6764c8ef4b41282f1c7b3796d3ae98458543add7e57fbed306bbd7a02ce0b5b1
SSDEEP 12288:1qfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:1qfJ4yL/tNCJPXUQrPq
TLSH
T1D4C423AB60D5948ADE1587F81A48F001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3bc8fc45b2d34f61a6bc4f56efbf3078e7ac9e49b6681ac3b8b3f47e2e08a741
MD5 e9b63d14649eb2506ae3576304739242
SHA1 880751a5b0f9eaea330818d4749b4029fefeb43e
SHA512 ebb360890a862ac3df417a65a13c3d35cb549a2ae432615b3842465c094edf4be3ca43e0c00f11e82a57bc081cc1f4902d44ea0a918c3ab2ca4f1301a9b7a385
SSDEEP 12288:vOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:vOfJ4yL/tNCJPXUQrPi
TLSH
T153C423AB60D5948ADE5587F81B48F000C7047EC6672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0954ffe0a5a7251a4ea7907e68b2b5e5b3150c2ea9d08050aabb422443f0d5a1
MD5 643f5c73669e84e0d5fb8ba12edb0b62
SHA1 246e662a736b1c792e287a683e20a23b237856ee
SHA512 fb3b11c9c1d94ccd45362135285537c23ec0a4edbf79ec5ba504b0d709d7fae6ec177a18cb0a35fe006d8b730384f9562fee42dc159cdd5fe1b1df58145b6686
SSDEEP 12288:0iZwbDzzFEoS2cPvyGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:XZM3zFVSOGfJ4yL/tNCJPXUQrPU
TLSH
T1700501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 38bf365a78cab9eb7d90ed39517a5af0a1a92d69fa12c89906b9d6fb346c85ac
MD5 846dcade0b39ebfd24743644210aa597
SHA1 21877912838b382aa6a3cbd333f4ec9287bf9140
SHA512 a0b44c3da819afe4338b40431053e37402ff4b0d541c1f513d8f15f0551315466efe0c29f0c4b20da72cd8d9d5cd6906582fdd0dcc60f414d83dc06c56b4f516
SSDEEP 12288:0LfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:0LfJ4yL/tNCJPXUQrPe
TLSH
T1DDC423AB60D5948ADE5587F81748E000C7087ECA772F62E7EE83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1187bcf4a7e1ac0570f1ad1a1d7026c12c1d61e09c3f4bf167d3b858b1fa47c8
MD5 86adab012039e01f6d1b680b70ac4cd6
SHA1 e82a6e3e64495980045d53480a234c0b2c98ea30
SHA512 f02793a397170f6ff233d0e7dce4d437bb17dd4cd07edac8e004b1b1a1cd19b4f01597b7ecb53fd31a8795b6268efde81ac01073a5729eaeb5d56e8c43288382
SSDEEP 12288:03fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:03fJ4yL/tNCJPXUQrPG
TLSH
T1B5C423AB60D5948ADE1587F81788E001C7087EC6772F62E7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 587b03186d50b8f7832968d662b8d27c5f362924cd282b56afb906ac591e05c9
MD5 ed6e3dfa9f7969490effcc0ef0754401
SHA1 140761eea8cbcd75c7fb241d15e7c1c0c9254a56
SHA512 9599ec391ae0e830622244219c9310533655365817bebb4e135484aacb42694d56d72d5e8251925606ebd89a2dbff369597d65919c989c8ede4c33714696ee49
SSDEEP 12288:2yPz5L8CfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:LzyCfJ4yL/tNCJPXUQrPU
TLSH
T1D5F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ed4dc32fffb8c64b4aabac46f56d7b33dc10bc9f2e120f0bccc9178591b6b82c
MD5 d866d8b329857ada6f29bbb51ac4f74e
SHA1 649b690952a1079a40b6108a75a74b0d530345ce
SHA512 77ce200de978bd0242fe4d05035687093cf184023f92a27a0df2dbf541a80ae068a349185023ce863b76ca4d0c231bb995442bdeb18a2b3a73ceb98c628f53a2
SSDEEP 12288:nLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:nLfJ4yL/tNCJPXUQrPG
TLSH
T19FC423AB60D5948ADE5587F81748E000C7087EC6772F62E7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 76539d9c2c38049515bf6236d0f68a3182c40919699427b0f6b7384c504e94ba
MD5 9b2b20fbae50e546b79295d83bbe4b62
SHA1 055771a134b757f8c3aa1f86a11083006ab06b31
SHA512 b312c3d85a1130f41088059a4705245f26e926566d5affde0ab7da9941e060805c60b8232a6d9f92d8683437e56f855d807dfcc5f53958e873e5c5f7f556f1e9
SSDEEP 12288:8LfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:8LfJ4yL/tNCJPXUQrPG
TLSH
T1C7C423AB60D5948ADE5587F81648E000C7087EC6772F62E7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1c39b766ab3289d63e0647239d98c3d81509560a09ad7d80c4bc42379c71cbb3
MD5 2e590d3aacd495822e69c22dfce2b80a
SHA1 506d7a3ed17f178de25d35c7a873db670a753f6f
SHA512 78867bcf121f5796d5b9798e4177072e0b949ef0a035ec8f0c09cadff0ec70f9e1dbb276c0e3395b6ab855f6ba14ed77a1a04958278eef19d540b3ec1a7686f8
SSDEEP 12288:byPz5L8CfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:WzyCfJ4yL/tNCJPXUQrP0
TLSH
T176F4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9f3fb08fc5a1dc3846a8802cd93adc5c8315d5ee5fcd656985cec5417d350b85
MD5 ac52655fa84b6879e19cf749473ae677
SHA1 2551df3e50dbe756b0a24702d49dcc94a910e782
SHA512 182793e5f310c754c99bd2623e65e474cbdd3c62a71c331e9e18118bd1b4840517c1fce57e36c9eb4e7351b155c49778271be937f80e31206bb6ef8a7e8bb920
SSDEEP 12288:bCd91WYoaLHF3z0z04PDvhEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT8:WT8aLl3z0zDEfJ4yL/tNCJPXUQrPg
TLSH
T1AA0501A9B39018F8EC67827ECD549502D3B27C9A0770C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1e8700d993252ed9649c8801cab6af40d3baf67c67e7ae9325529d772d5cb68e
MD5 55d81dd4ef375634d625801a900dba7d
SHA1 6eb1c03d7b75cb2cc5684151b427b799492a6a53
SHA512 6eb6a8592908fa2bf191cbd5a854fd7cf755923888dac302049a5daa896b391d828f49213540a6e7671bd65e9fe35da8dbf298ef3bf5e0a6d5d01a9f89ead739
SSDEEP 12288:Hi4e7+RdTfgwCHKy7GLbbdIvRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGw:H3rd9CHKy7GZ4fJ4yL/tNCJPXUQrPL
TLSH
T1BC25CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8c37bfb5a127ad5cb8d27901d9fbd760d7eb01b429cb60ff6492f3bd515ac7b3
MD5 e7addfb78fbc5ec8a007928d4c152b03
SHA1 35f17768f26b7ff58d1a0568c818292481d4d885
SHA512 0f38e6a261abc4100f565a973c844a56ff2bb56d60408788a45ff46cc66777ac5b4b7cdf1de7b410402ca27af929c41042ed6c2a50d382f80f744ab405a854ef
SSDEEP 12288:TUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Ss:TUfJ4yL/tNCJPXUQrP/
TLSH
T1B0C423AB60D5948ADE1587F81A48F001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0d13fb44d6fc3e836e6b973dfa2074c22867bce728586f4b66fbfd12f5da57aa
MD5 bd44487ae5aae26a2c25b91036f1a4c3
SHA1 561b4e51f65930c4348a1a813d45709d6f9c663d
SHA512 0f53f19c06e581002e398111aa0ce5ae0ec05a6634dc27a658817130f701dad3599a6bd151be9991bcfb4f6e91ecc9ffa3c1595e9fd29cd1b4a1f0886942a4b7
SSDEEP 12288:FpsfbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:GbfJ4yL/tNCJPXUQrPC
TLSH
T174E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6915DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9d9bc066aca43f0bd82bb22432a567c893c59f0f8144d9166e132ea026df78f4
MD5 a60ee5b709afbd001c62a01207eaaec5
SHA1 3da3b6385ce75de42649deeaf2f59cccea1df3e2
SHA512 82dded695368d8dcbbb7723133310fc558253ac40e41e5225d152996226a0adb9937f57a3ffae0ebada8c1e913c7c797206a29c6cd9189ded6fc3756b4039b83
SSDEEP 12288:xcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:xcfJ4yL/tNCJPXUQrPn
TLSH
T119D423A761C89446DD7A87F8164CE000C308BED56B2B92E7EE4274857FFC99A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bff9b79eec6ca64fb24a54d641d87ac143803ca3df93c315595907ca7a8e350d
MD5 1658422f49ba0ca57b3f900c0add8c35
SHA1 584e2e1dc9642e401c2a1e9f75b983d8a4bf712b
SHA512 31c98676ee8d99d2e61d23c447882431c61c09cca69d6dfa9446a18c8aa5f001fec11c1d52e1b69274005966f788ee2cc341f1ed8394b9a488da0d2be8550b22
SSDEEP 24576:m8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCWfJ4yL/tNCJPXUQrPa:fRZwQCyiHiQEaaPnM/fJ4klKXnS
TLSH
T1BA85B01E62DC46A5E0BAD2B8CDA74407E6B27816573193CF0191C27D2F27EF45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 74df0c815c969204abc6cd012a387fe5eb037d9aa2295c88b0133e829d1ccf87
MD5 ee9422bd35fd7b3765b90eb67995d182
SHA1 669b5f94dc5fdc0480b463deb8854a8d781fd84e
SHA512 ad62fbec8bcb4bf658bc5ff13da62e05742a81ad129bcd3a94960f89f9ee0e0c165680e033605d8576087420487f22ad2c3d70c924189c36f0e3004d7bb6d624
SSDEEP 12288:obxA1U7KBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:obxA1UGBfJ4yL/tNCJPXUQrPZ
TLSH
T135E4126F22DC24E5E576927C4984C001C331BC962726A3EF65C1D17A2F7BEE91C39B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6ab4dd0c2329d6f39408af6889fcdf82a455570cd273d4ab12004df077ed6c79
MD5 fa3a888f36e07be4c4c3c1de406190f2
SHA1 b926a106323a7f36aa4f590dc770081fe414eeea
SHA512 b4a7e301ffd4345142f30bf4568320d92516ade73777e2abbe58f783c2230ba1d7287fcee602972bb79f6298672391bab9932071bbd2a3c8200e0eca3f5d4370
SSDEEP 24576:djsmP0yHaqrVqHra44KDzMsrnYfJ4yL/tNCJPXUQrPi:djRP0yHfVqzlAsrnYfJ4klKXn6
TLSH
T10445BF2EF2B910F9D8AAC176454143B5EB71782D1F219AC70170C634AF0AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 103c6f3f2c912749b30115097aecca4dca534df66440ffd6c9a6332f051306ce
MD5 fc1fa21fee615076874f6b25769b6d52
SHA1 8af2f8ae4387644b84a3264f97caa7acb89d4bba
SHA512 ee8ce8b7e4e6b45c8ec24907e5e0518d8c608c612e10e688af9be606b4140654d48837b244ae58fd0ba7b6f8b9962b8f0012cf027eec4139d64f28b190bbed04
SSDEEP 12288:z+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:z+fJ4yL/tNCJPXUQrPd
TLSH
T1A5D423EB60859485DE6587F81648E001D3047EC5272F63F7AD82B4827FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 1e07a8f0ffd84254289549eda9b42851a3015b2d5005806c79171250f76ef530
MD5 55810efeca893aa9c80c4a37eacf872c
SHA1 672c4600213ac675f8218963b41b1da738319081
SHA512 ebd2245f47c7f1a66c4db656ae187b7c9e0d979ce3afeea0710309c6575417f16f670dd0dd374ced5e7b0b318c54ecd513ab587a1b91eca82e71be10d23aa7b6
SSDEEP 12288:AObIA4LWO+vAYFTgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:9ALBUTgfJ4yL/tNCJPXUQrPN
TLSH
T102250155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 ddbca6f33cd4aa83f27b4780e9123b3aad007fad50560e1d12906803c4567e38
MD5 2c187538ea29b8c7875018d2c0464bff
SHA1 612434b537766f9521c9dce2e7452a5a2765c227
SHA512 dc2cfc7082a1df04e9b610c407269e03464db551a55c0e27c4000325c621da6b9441bc77e72eef341279cc45eab93be8b3ac16c25e7ee165eb52f536a9b833e0
SSDEEP 12288:970VmzIYNvUyBpTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:6fYNHxfJ4yL/tNCJPXUQrPo
TLSH
T16405F12F62AC08E5D93B927D8AC2C105F3727896171692DF05A0C2BA1F67EE97C3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5d3705b07c0eff77201dc6a2fc80810862136e76893cceb9cba3e8c4786cc61a
MD5 51cf73e7e9044d9f49cc3513ba7cfcf0
SHA1 82592335d60a45bcdd77cd3832bbfef89f18191f
SHA512 805b8409736e15c01c85b641405c12620ff914740aceb43381689fffb56084c516571ac72d120532ad48d4673545af7499708b25a61cbbcd1b7c7203c8e1d334
SSDEEP 24576:HnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKF:HnXoJJYH84VVS6AmETJas+cHBjSSKHPV
TLSH
T19D65BFAEA2BC04D8D5BBD17CC5C29506F5B178621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 446987f9ec046556c3f93de164c4e9bba8198b14bca18ab1dfab93971eab922d
MD5 ced98d5dbf2b9bca21f7765fec7edc55
SHA1 9607b676a30d3815ca6e985a93c041ebe17eb309
SHA512 a48da9d42b91892cefa5bb8ae7220cb273a4d63a261ed6d8e39950f11d80a04f17538ceb0f528d247a5be23a98242604c611ca3a805bf8aecc3cee52c94050ab
SSDEEP 24576:Kv7Xbxd9Tuycf8M/TYlSuxwr2PCbfJ4yL/tNCJPXUQrPN:KDLL9TuJ0M/TYW2PefJ4klKXnF
TLSH
T1DF858D5EA2EC42D8E47BD6BD85B69047FAB2B895173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 ca8695d627f5a34a22f818b58cc56b3e611fa0dde07e4d6389cde28d1f9eddd7
MD5 e1534414dec2144391664f1a5ec8f444
SHA1 3ecc9000281685de75b6c7871a95575df93a3ff2
SHA512 46fa5c84678dfa2a8fb848dd445c39f72bbe453fc0b431367847bc61eb2eae57655b548fceeb5cf481a5b3312c19f6ae74b45a195f85c44073685747329c56f4
SSDEEP 24576:tegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wgfJ4yL/tNCJPXUQrPJ:tngOJOmPOHkgfJ4klKXnh
TLSH
T14B55CF3FA7BC15D5E03EC17D8A968806F6B0786613265ACF0560827E5F1BEE42E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 944ba03472cfdcef73c3fd0bc309fb945b56023e6c65a3b957c8698aafb349c1
MD5 40b13fc4d28deac5d805acf2fccb36dc
SHA1 c60efcc7d929eec35005377c364ce074596216bd
SHA512 0c6d359b93daeb00237851dd92cd6add4f50f5e1c86024152574c82a7ba9f8c8fc8a0a73ef8327faa52c31578adf21ff1cd379944d9a29adf28b8bb1e184090a
SSDEEP 24576:ALJnJiTk3R3waE4JrOefJ4yL/tNCJPXUQrPx:ALJnJK8R304ltfJ4klKXn5
TLSH
T11B15E03DD2E810E8D4B7C2B482596656FF31386C2B2669CB59B4D4313F12FE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e741538a5595aba57315205250f1cce86de36114a9a58d0be8fe6b2f2e96862b
MD5 d3b275b35ab3d78390acb72ec416b6c1
SHA1 7f80f68de850b3e2ba4420c2aa6795367e6b9b76
SHA512 6c9c9cc0b8e318407df1fa507dc420522de212ad4cc6fdcc41175a7db3fd994c4a60372ccb765729e319ff839380f9e48c8b46e5637af40beb739361b1cea1e1
SSDEEP 49152:89GqCzDScAZmlvTcFg8Ph6KfJ4klKXnC:GRfJ4k
TLSH
T15C955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 d7b9e9f7f5e9d3c8693334d81216cb3342e24ab0dbd9d49d1f0e7020b0eaf379
MD5 f84c856d1ec83964433a3dac0a335526
SHA1 e99addfbdc514e9c894cdb0c86abd1f2ad2cf816
SHA512 09feffd895bdc663a5d0b9c355351882b90ed9e524ef3fd4705c5759aa1002d2c5415416d496f4be51cbf54f4699723ddb344daece1cdc2c08786339a02fea7d
SSDEEP 12288:ilYJeXm5nkEUuEtfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:ilYJeXm5jUuEtfJ4yL/tNCJPXUQrPN
TLSH
T101E4129E319C70E5D52A82BC5594C100D331F8E5231663FF96D0D1BA5FABAE62E3CB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 0a7c273d8188aff2f9997d91cb3e1bd8eccdfc8747be116170e265e8c4f16ea7
MD5 0b954295f99761c1044859d1dbfbb926
SHA1 e6725441ef6ea1def5a6370dab6b92731f52b4b1
SHA512 2335a32d138f5f4b2a27550cfbd182bea9f79a1a91aa48f87333f4aad388fac9fba9423c7c10627c63ab20295259e13fde3550ac0434c7454ce65561d87d579c
SSDEEP 12288:fwu6ky9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:fVty9fJ4yL/tNCJPXUQrPJ
TLSH
T1A8F4125622D4A098EE7547B89A91C040CB34BCA05F2693EF99C1F53F3FBABD56834712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 962938207e9d2aea83a31ab791224e3fb5cd8a5ae7207c3fd5d511854c82d0b8
MD5 ef24c2b4d0ff219ab2ec517b1cdc4077
SHA1 cdae9df12304055e76c96ed455b0deb0c1efab5b
SHA512 ac0f463a97e524bd3b87a08cc1e8f2cdc28a40011e2aae273f4fecc2d055dd1c56ad7278a43bb3b1b98a3a8bea9d5228fd1d0b74175efcbe8a5da0f6a04fd335
SSDEEP 12288:aPgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:2gfJ4yL/tNCJPXUQrPS
TLSH
T16DD423AF2194A089DD2687F81648E000C3147EE5272B62FBADC2F4B1BFFD55615BC792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 18e15a42e130812ba4e5c5bd26594edfef52776a54a3bfced46f17c52473bf0f
MD5 14b3a6a9b14d3aa708a0840dc899b6d6
SHA1 cbd2defb19cd86827d1440e8b0d6b19f930d9c9c
SHA512 7202e8632a04adda1e75f3312c56f10895106bbb654f03600a17f0e53a6b26d22e09c8c71f369279d7a8122cccfe9bcb7623c761c49ff5d83999a10d4679cc03
SSDEEP 24576:nC+TyQIu93VAumZr7jmHfJ4yL/tNCJPXUQrPa:n/TfIq+YHfJ4klKXny
TLSH
T1D8558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 febb2deafb1594b7e19726eb8d73c2bce73124965fec5e03fdd661aba4b4d8ec
MD5 24d8cde5448fced92c4ba52f1a0d3ee5
SHA1 d4625301cadd4b8e7aa9f4723dfa72a263c981fc
SHA512 635b8be3dd97652035c261a6eae8316af06c5e6cafd56ed31fbc0216c0d4be2ca330501819d9990f294ddc412dd862ee3f521b6ed43a002e707340acdc916b07
SSDEEP 12288:ccyrWOstaa3kcsEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:ZLQikZEfJ4yL/tNCJPXUQrPu
TLSH
T17EF4F10FB3AA0095D5A7C27C88848102F77378B5572263EF4690C7791FAB5EA7D38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bf160a3f3c600bbbbfc38aad514e0668d99a6d98a6909796c95c5e22ee361ddd
MD5 de39f74fd3e09bfe5c7812a9ea63674e
SHA1 6dd6e22541b07d4e5dc9d01f658415739b1e8be7
SHA512 c8786d8f843a1a9c22ace29d3d1ab4f3f7547398a5df704f1c77d2887539dd2c16929f93a0ec72ba5a531c55b8c241a70616daaafcdf4cec633e7bb3a043364f
SSDEEP 49152:rpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP9fJ4klKXn2:ApC7b4+80GTkCfJ4k
TLSH
T139A57C3DE2F810ADD9AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 aa91cb9d505ca0cae64b1f8ce0727a1c65f64bffc6ba946c39ce16658857e69b
MD5 d31e673d471e46f01c439b322c85e645
SHA1 021afd0d108a2bf874146548ffa8612cbd81ea94
SHA512 f9424f2914f322da6ea3fc8ef98733c8b51403c18989577f4ca37ad6c265da0bf7f8293d1735e9c93d3053039f453cfd32718edce1afc704814b68bb3b55f64e
SSDEEP 24576:bSAwJPE1IDAo+4Kt+l4413lUQgfJ4yL/tNCJPXUQrP8:bqPCIo4Kol4jQgfJ4klKXnk
TLSH
T10255BF2AA7F956E4E17ACBB49663C101FB727823133163CF9290813E1F169E85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-306-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/240-439-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/1036-342-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1036-271-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1240-339-0x0000000000660000-0x0000000000736000-memory.dmp

Download

memory/1240-340-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1240-338-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1288-446-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1288-329-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1288-327-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1288-321-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1356-506-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1356-355-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1592-278-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1592-285-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1592-279-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1592-346-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1848-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1848-234-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2096-447-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2096-334-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2456-367-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2456-502-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2456-302-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2508-48-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2508-46-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2508-237-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2508-240-0x00000000015C0000-0x000000000166F000-memory.dmp

Download

memory/2508-40-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2644-347-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2644-465-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2948-290-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/2948-295-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/2948-351-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2948-289-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3388-481-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-484-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-482-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-483-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-471-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-473-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-474-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-472-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-480-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-479-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-470-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-478-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-469-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-477-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-456-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-458-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-462-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-463-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-464-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-461-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-459-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-460-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-476-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-475-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-457-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-455-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-453-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-454-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-452-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-451-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-450-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-485-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-449-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3388-486-0x0000012F918F0000-0x0000012F91900000-memory.dmp

Download

memory/3528-239-0x0000000001340000-0x00000000013EF000-memory.dmp

Download

memory/3528-25-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3528-26-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3528-18-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3528-236-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3540-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3540-69-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3540-83-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3540-85-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3540-64-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3588-51-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3588-57-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3588-59-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3588-238-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3588-241-0x0000000001670000-0x000000000171F000-memory.dmp

Download

memory/3964-81-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3964-242-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3964-75-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3964-74-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4984-39-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/4984-0-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4984-9-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4984-8-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/5148-354-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5148-299-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5420-384-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5420-437-0x000000000A1C0000-0x000000000A1C8000-memory.dmp

Download

memory/5420-421-0x0000000001F90000-0x0000000001FA0000-memory.dmp

Download

memory/5420-365-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5420-512-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5420-466-0x000000000BD20000-0x000000000BD28000-memory.dmp

Download

memory/5420-359-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5420-405-0x0000000001CE0000-0x0000000001CF0000-memory.dmp

Download

memory/5556-448-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5556-343-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5700-444-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5700-317-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5700-315-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5700-309-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5736-352-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5736-468-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5884-32-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5884-31-0x00000000007B0000-0x0000000000886000-memory.dmp

Download

memory/5884-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download