8373df9a0309dfef620a0dc32474e238f1754f5e40fe2a09da2fef53fe4b495b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-08_f37ed181c44170107d3b607ced04f780_cobalt-strike_icedid_njrat_vidar.exe
Size 3.6MB
Sample260608-pgldfsds4q
SHA256 8373df9a0309dfef620a0dc32474e238f1754f5e40fe2a09da2fef53fe4b495b
MD5 f37ed181c44170107d3b607ced04f780
SHA1 874791d177d1fefea857b13504f37ec231085504
SHA512 68a3ca826f7ed832d2c53444dff068e6d7ddc63524b4c519672f1e470fa88fb165fd894cf9efbf65df451b5ff4ed6020441605312de3c1b51682bccd1d280471
SSDEEP 49152:u1d9nN/BGSAB/HKQc+YKUDmftcEZIOVLkEH95IE87Zxlor0v9LNiXicJFFRGNzj3:u5GZPKUt59xwxw017wRGpj3
TLSH
T1B6066E57A6E730E9C8A3D139D6129601E9F33FB203113BE711984D612F2BEE9067EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2448	alg.exe
3008	DiagnosticsHub.StandardCollector.Service.exe
3528	elevation_service.exe
4424	elevation_service.exe
1080	maintenanceservice.exe
3448	OSE.EXE
4176	fxssvc.exe
4896	msdtc.exe
4400	PerceptionSimulationService.exe
5032	perfhost.exe
636	locator.exe
4520	SensorDataService.exe
832	snmptrap.exe
2264	spectrum.exe
1824	ssh-agent.exe
3596	TieringEngineService.exe
4584	AgentService.exe
4524	vds.exe
3300	vssvc.exe
1848	wbengine.exe
3768	WmiApSrv.exe
1956	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-08_f37ed181c44170107d3b607ced04f780_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-08_f37ed181c44170107d3b607ced04f780_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-08_f37ed181c44170107d3b607ced04f780_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-08_f37ed181c44170107d3b607ced04f780_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b05726826bf7732a.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_176265\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050e9a88c41f7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000472a478c41f7dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be4bab8c41f7dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd71d18c41f7dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3008	DiagnosticsHub.StandardCollector.Service.exe
3008	DiagnosticsHub.StandardCollector.Service.exe
3008	DiagnosticsHub.StandardCollector.Service.exe
3008	DiagnosticsHub.StandardCollector.Service.exe
3008	DiagnosticsHub.StandardCollector.Service.exe
3008	DiagnosticsHub.StandardCollector.Service.exe
3528	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4428	2026-06-08_f37ed181c44170107d3b607ced04f780_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3008	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3528	elevation_service.exe
Token: SeAuditPrivilege	4176	fxssvc.exe
Token: SeRestorePrivilege	3596	TieringEngineService.exe
Token: SeManageVolumePrivilege	3596	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4584	AgentService.exe
Token: SeBackupPrivilege	3300	vssvc.exe
Token: SeRestorePrivilege	3300	vssvc.exe
Token: SeAuditPrivilege	3300	vssvc.exe
Token: SeBackupPrivilege	1848	wbengine.exe
Token: SeRestorePrivilege	1848	wbengine.exe
Token: SeSecurityPrivilege	1848	wbengine.exe
Token: 33	1956	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1956	SearchIndexer.exe
Token: SeDebugPrivilege	3528	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3780	1956	SearchIndexer.exe	109
PID 1956 wrote to memory of 4632	1956	SearchIndexer.exe	110
PID 1956 wrote to memory of 4624	1956	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-08_f37ed181c44170107d3b607ced04f780_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-08_f37ed181c44170107d3b607ced04f780_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2448

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1080

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:960

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4896

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5032

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:636

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4520

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:832

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2264

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2288

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3768

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3780
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2884 2848 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4632
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2804 2872 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c4973c307fdb5151934bd611782edd9fbd8b86ec01bcefad6db2dbacbc1112b4
MD5 9b4be96e3b181776fe6c11e317d0bc46
SHA1 234959c8bf6fd507941e7aad13eea9733cf4fdd3
SHA512 d8f11d5b3b9634ed9c422f0f61ded237e1a626157f29ceb46cc049cedf05d80a7847754551264625d06120c007f68d612e7a62ab8419bbdf25469f2d128389ad
SSDEEP 49152:Wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnNLNiXicJFFRGNzj3:I3q6mjBu7wRGpj3
TLSH
T195D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 682d709ad027c323fee96903d3442b7ca67da003af711a981d8e901dc1971af1
MD5 230b74da80ca44e38b8e75b1f1ca6909
SHA1 07bbb0fac3eeec070e8a8d306a5c8ccd6a9a4897
SHA512 ede2d036be75edbbb4dc16e58ca6f79252fa9883d2830015ad7cb01c566c777785f67dee89ed54a87046fdc23146906a9613b431d9c262cf3c930c3bf9de0c29
SSDEEP 24576:qXYfDtczAK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xtcnLNiXicJFFRGNzj3
TLSH
T1E575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1b407d8445b630c7817d2ec6d1f9d468f923e854dff25275f775248122a0938d
MD5 22cce67f33d3c39547f9a2f57c41d4ee
SHA1 73bf5ccec47049f903b7417f3a9679fe80ba21c3
SHA512 164f5d30b50f9835b9502b852cb8d86b36b6ca99aba5ff0a917efbc48b3f635340acf301920dd9b155937d880d016276531170acb89aa6f1542b982e45ac1a14
SSDEEP 24576:Y0Le5ji0hmxhrMV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YPji0AzwLNiXicJFFRGNzj3
TLSH
T1D3859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d25c90c5e9f85aeea39d31e57e07756ef2ad44a080f761cc60ac910423a228af
MD5 87cf2278f3f015e329d07e6732d8827b
SHA1 e2cb73d1bc9a92a14ac123890aa9d30e5e0f451b
SHA512 ed5331affc36ed44620080366a8ee71ad148c00c36d6d599abeac9ebc88d57fd98bde36c4060df4662e09135a40c573301bf444851375da66b32fd9ad16a9ea7
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyu3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+/ezSC6vUzPv+HjycLNiXicJFFRGNzj3
TLSH
T1C8756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 34c4f8f5bdae23be75d2db9e1fea705341ab60d3ed26f507da6210b531c5161a
MD5 0b7e74f75b3322a92c70488f9a2d0ec5
SHA1 fcfa96dde88f07be6573781803de452dd94e01d8
SHA512 75727a983901dcb94b4f6b82324863e4d558c2f6d5d18f72f0784ddaef2f10da43f0d836e5aa0dd0c104410be7e8fa27ed43ddaca92a3e924d244993492d75bd
SSDEEP 24576:IVbqPb88hv/l+B+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IVO88hXl+QLNiXicJFFRGNzj3
TLSH
T164559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f3a8265650e9690159ba0530143809fc6d73b334299a2b0d044e81e08c79793a
MD5 2faeed5e7a159e0781b780ab0a429761
SHA1 bc3db697f75a21bd4d0ed641b09538c3bc645203
SHA512 54fbb2ce85885abbe90cad94b1120c0171eb3c4707ca06abe61b56cfbadb915e1c1a4fe0f4348a68b1d64bd78f7ba0e37c44feb775de5455de31841c857ac64c
SSDEEP 24576:eGZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7LNiXicJFFRGNzj3
TLSH
T1725523D3468854B1FBFD0039867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 91fa3bbc2780da0a7c226296e3dbf9de0bcce7446da5cb695c605d6b96b618f6
MD5 dc81890bc9df5bca4feed76c76514ce0
SHA1 6213986daba3e70d277627b1051de93e3a83cbe2
SHA512 1d0da329e6abddfe3f84c18d7bfbe2cccac8cceac0a500baed13be2de3f65b0c515fc4c515c42b5682410e470c69340dc28234ea7328f5c5aa06c575b5b0e0b1
SSDEEP 24576:eJIUG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJIUGLNiXicJFFRGNzj3
TLSH
T1E175CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 386d61743d25a8c0731064d1a048238d8dc5272855b7080d72dd4dcc2d6d2d63
MD5 9130106027e032fa44e03b74aebc80b4
SHA1 e006811a79eab99b8318eca696a876eeb97544b9
SHA512 071c98c5ea5b1813ac39d3b4ddb19d8e3d19082156675c151e8dcd9481b8225a6f957bf2be40b7f9a5f2ecf8fdab670d1ad2e118da11828147559782d0ef9d3e
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THY:PQvGAdlCEL8c/WRNw5CH7wRGpj3
TLSH
T1DF266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d5e24ee194213bb77bea0e593d4a0ac07802aadb1c072569d0938c6e6a6b13ba
MD5 b92d4087aa8ae046c9d0de36dc5b2601
SHA1 4e8accdc2584f968043b294a483a4c87318c8a16
SHA512 b5fdc9695d013743fc6bc5084cd1d4137930ecf050a8647f014ff655267a0b6d41f2a0464be3503809828c5b6607e81036939c5407b24edab028689adb80f6b0
SSDEEP 24576:sfewsAjA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OljALNiXicJFFRGNzj3
TLSH
T19375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 813cfe9a3bfb159a3c5a2730cc487cffe3999f163af4d7037a7fa9f042fd48df
MD5 22110744d12cb242a01e0cb1a76f0f79
SHA1 d750d765809642da337e2e63b648c0aeaf7e4b11
SHA512 e2261520a7b555d2c8505c01a53e15a687b6970b636294446744482a3aea563b48296a46ed8ea7b9297b437f3e9dc58b03c72d3dd9b657f6bcc4d440773c1c30
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHEF9:HUEtQevvqc2W1cpV20I32Y9
TLSH
T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 19a92fa831fb7a14e56e7bdea4b11e5d6336b4f1569fc24e0e4ea524b432e64f
MD5 adfdc433b0ce13ecb51f30d276197c60
SHA1 cd624ef47b88843466bab3460b29669bcc00044c
SHA512 d2aa4ea68ee4b90ca760794c961f2dadebaa99c856c698cb85c4de6550558d657f7c1d62f28cb3610396bf7597a6ef70d7baaa43d907ad4c95e50dc9d33a5b14
SSDEEP 49152:HCbRquA/m2yL5zLfFiV+XenmE3/zgLNiXicJFFRGNzj3:Qoq2VjnmD7wRGpj3
TLSH
T11ED58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 90dc01c2c15185a96fb1b554ad5e531bea1b5199fe34aeec9d44b023ab7da4b7
MD5 fefcb5b095a478f7289d124e124563c5
SHA1 4e50c7b4316c71f2a3b3b6e75b77904e503a1f54
SHA512 bba7c12b6d639a83eeae9f4dee463aea1b3e3597482c5973a7e628a3fbc64312f9800db9db83ed89c8f70d81daac0886760f8452197ab85dd03a2ec83bba1c64
SSDEEP 24576:zAhGL6IFoiwtA5l7S53j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zAM5Foiq5TLNiXicJFFRGNzj3
TLSH
T105359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 eff63fec877e003ae790083dc346e2d509eabb947e5fd677160ab673098959cd
MD5 607d3f3b3ea0d8d95f4c6ab18b02daa1
SHA1 18f5c4cbe15c07750275e92139a6b749d6472bc5
SHA512 1c60f23fe3c91a56ae43bdbed9eae809c061c7625f4254b9664b18075b54e97dc3edb71fb32ebcb3bd29834f678d4573a631359889fc5d62033efb2134fd174a
SSDEEP 24576:jwuROW8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jwSOfLNiXicJFFRGNzj3
TLSH
T1A865F18632940CF9E9BA41398657C036F7F2BC152A25DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ef2468f935fcf6f27c009629fdf5479b22458af1b6697f0d2e8bf2051adca953
MD5 2ad95a3030d75e3f3a6cb6a9587d9f7b
SHA1 ae276fd76dc04051232f9105990bf9ffc6b9270d
SHA512 8d8c5e14ecb5c1b5cce5ff7a82a15dd4f68c351378a99be913fd7c14f76dbc3f1089c1744efae5bb11ca51119b4648c4f52788ea46611a9f864b5f2f22d11d25
SSDEEP 24576:HZud/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gLNiXicJFFRGNzj3
TLSH
T15D55129622C420F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 94dde63328464c35b5b9792410d9958e288de8d318ea450f6850c4fe7b02bc0d
MD5 6154770209dd8b05bbb42b015e2a25b1
SHA1 c132c34e2132e957ce891d640881022f6397cca3
SHA512 37a77d684f021299d0e41e0930508a6db86b832673fe5a17d285014c0b21529f2465d8db25c3ccc87f005f164c9f27370d2a9b6f62baa22005453543bd292f90
SSDEEP 98304:BQRQyi36YOcPDLvw2gAf+PN3S7wRGpj3:YQyiKanX+PNmF9
TLSH
T1F7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a12ec44ec3edd026ca60a154955345eabd1318a2422e249f6f26a24553281d2f
MD5 9c0eeb0d1e0a61258baea60a939348ab
SHA1 805500fd0a433a8e0fb2f4308cb25234f29a77dc
SHA512 c430a54cb02e458da836d5b309b067d47cb05bdd679a69876ca888c7877a32cd74412cb06a210ede2f381632796e33cd475d9c80744c924ce0fac360283d0e57
SSDEEP 98304:lQRQyi36YOcPDLvw2gAf+PN3S7wRGpj3:cQyiKanX+PNmF9
TLSH
T1CA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 387709bb982b089a7f61d58bfd8b843acff5a5558539cd5c549806e270c7e365
MD5 75639164133ee67dc1ccd4bc29d1315d
SHA1 1db5d2cde6b2c1b34a0c35245060569833ebb42c
SHA512 e8850f4a8ea60c1c2f11ec47a31391eb22fc85fc90ea5625d72898a8f7af477edab20540ff99c96ad7117de9a1ccadec04f6f079b02baeed25bdef81af06638d
SSDEEP 49152:V68Qg55nhkeWu7PNU3/wLNiXicJFFRGNzj3:jthTRc/w7wRGpj3
TLSH
T134B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5cf2ee7ca7ba7602b766fc3119952d5bb8e189dfd012a527f3e6727cd26ce292
MD5 7e8005f9c39871534341098a3cb36924
SHA1 4bfff62fd21d1c518271b588d89561fb29afba66
SHA512 ce8766af1bd8a606b81b90171971c0d2c540bba525ed59b7bba1d9c5052fb269eef12ce8cb00648cba5ae5648ef3f18365c5783d5b8e76821af7880e430baa3d
SSDEEP 98304:xy5112gYy5azzVvU69nLKnhZZ7wRGpj3:MLIHRWh/F9
TLSH
T19E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2f74a0714b3ba61c8faa7fe1bbac0a05bf24a93007398869df484cec6a336f76
MD5 be46dee3272d5a63083213f757bff822
SHA1 7dae78189b4cce8a5c23a73da819089f02cbf5be
SHA512 05bafe7c4bf11417feeba2a3a19bb2cab838e07548c25dfae7b06d999af32cd01b6b847328a4e39f42e8f5346171c8436037c8f011601acae53222852ba3d616
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl6LNiXicJFFRGNzj3:6u6JmIxd2d67wRGpj3
TLSH
T1ECD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 65a57defb73b0b29fb3af5e5f50f785939a8b1e97119509f5f305802495b395c
MD5 4bc0eb91354f78ca17d960302c53f1e9
SHA1 0acdbd1b6e58f99606891d59e9d39f7d1d8bd18f
SHA512 3e4036fa11fe58b74a1b5e3a7df651028fd3b872d09d48335065e87d2ccefdf569593dd548ea433c76e25c633cb2e71d1c545993a100db49687a4a8cc16f74ab
SSDEEP 49152:01hpsNoJpF1A67U44CwH7R4xmLNiXicJFFRGNzj3:0mifPqRD7wRGpj3
TLSH
T10DB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 349d7724b2172b0d501b3384b8c10797b8a2b3ff34164d1d3f8ea6bcc974a3b6
MD5 1d98de9ea16509e7f864b41586ce3eea
SHA1 aa3ec79a1dc23c9e2ab0fc4eb3b28ccfdc2ef8a9
SHA512 1e78580a86f26e17087bb1c493d3b8ff4ce0b23dfd2393cb0377d32f0f24848ead16c1f69e426aacf12962f7cc2e4406a4c8a408c02752619580ab5741ba38e3
SSDEEP 49152:2SuZQIY0Be2KkRVtOnks6NMHqdLNiXicJFFRGNzj3:Y5dKqi61d7wRGpj3
TLSH
T19FC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 863a8d7d771c9aec754e74031b35cfe1223327924b02f22559170711e6dc0a84
MD5 b602c667248e4449c7d6e8df80a56e3b
SHA1 ef4046dfa066f006e1c3d5d49b0a513ec27b28fa
SHA512 34279bac6bb47f46e330121e9b4b52a3fe13082a5467a3404bbf461312746d36a717bae4b21410094dd034f073f18e9eac9fa3d1db6a3abfed2c5a9b5d624c46
SSDEEP 49152:OhtSn8EApI0figjgiDn0AP5wKLNiXicJFFRGNzj3:PX2iWph/7wRGpj3
TLSH
T10B95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 66968aa0887d4482c1b6165fc1db44a854747d3b40b922db8e02503a6eaf73db
MD5 5a770e8684bf3bb1247f5dc032efbac9
SHA1 0f4774d6dc6281ea0126f2511845e8a522b5e5d8
SHA512 930ed43a092479959da2e0d7891e8fbe016e33a178607fa2ebd36db3e4a005ba2554a3b79ecfac1a91bb4eb52901427d410f1f58ae0762a11f3835b1887fed4e
SSDEEP 12288:gdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15E5523D3548955B1EAFC0039C6765428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 519e8f2ad821d155d58f51eb10511f78a96541a252a363108df680a8cdb53467
MD5 a576ac576c926f7271ff47e25c33f774
SHA1 4090c051af10d8b39708e0a57a94618b4714f1a6
SHA512 b17e5bbdce703c3c568701327ef73acaed85405a83cf50bf52437153dc06512823d1e2f002d6e1da292119e544f3e2720880b10b0bb129e97d829248865735c0
SSDEEP 12288:0SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:00/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1055523D3548955B1EABC003986764428F5881E2DEB5619E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 743e2ae7ab78bd090a87a62cdeaa93b1a9982ad9ebe5124dea37ecaadae584b0
MD5 cbc5c6fc343f806ba40f2f59144c7100
SHA1 3b4641df10b02ccd88fbff552c70b6aafa5c5933
SHA512 ed89889584b788c79728063a2a5ff333d7f7594ce8452bb210728b8a6b3f951c6d42b4128c3bfee5d4eada8bab7c1a81806c5078ab511735b3fe8febc3649c95
SSDEEP 12288:XkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1685523D2548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 611415d7400769eac52395c39309fa757b4a2958b3760a56f701f7beb3696af1
MD5 90744fbf9720aa20c111ae3a3f040bf5
SHA1 ab848c03e239a62b076c1c04679055d101a41fdf
SHA512 d475d92f5ee5ec1c8f35419406871c11d90e6c314001907c0148f423364cfb56ad72536a025087fdf398f97a6bd3e1d81eccd13c494e08fca0383526f6599999
SSDEEP 12288:rV3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T113552392168901E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 590bb6e06c6d32a090069f78906741678ee52cd8b160a4bb970c727508469b4a
MD5 1ceea9e9eb4decb067643162f1d5366c
SHA1 040aaa0692fced7931f9c249249fd1ca1906ec92
SHA512 0c84ac87615b38052538a00754bad49c857a33d790ab40104f13c55b4be383ac9fceacb7ef976fad8ab36d6ba227f3ea2e8e087a70637b0c7f0ed14912babfcc
SSDEEP 12288:hviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D45523D2548955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 66ab2c235bd9ce4f9957604c77748a5ed6e8cc794b9d623d41412223ed38f830
MD5 eb79e2761b915b6e2460c24e0fd52aa8
SHA1 5986c0d5e435a4142427367f6529d028ee6370a4
SHA512 df8bac3c0f7e53c4fdbe31321eebf6421bc190b447f91dc585e20f4fdb0b50ada0f86ba1683222ab5b110ae9f0ea110a692377254fd2a0f559da789aa15d3613
SSDEEP 12288:5eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C15523D3548955B1EABC0039C6764428F5881E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4b1f41991580b322e42eacff636a8e52346ed2dd303dd1fbf8bb16ff6cc728f5
MD5 5face97549a82803eefb8ff3d3973810
SHA1 007d7d493ac49666ba8bdeef9b9050f1079fbf7a
SHA512 56730a0008ff5fc52ecd9f8155cec6f81445a541433c967513e2a115c1c302693b81b67ef6be7fb2c1dccc5c13387ab5e7d8ae51953f7e72e9b66d4066aec0c4
SSDEEP 12288:2qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D2548955B1EABC003986354428F5881E2DEB6659E3E3483D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 98fb54fd38c6c67c927d7d8bff5c46a11752aee959bb060b9b57335b9926a43d
MD5 c20b8dbc9f39341b5f26240d8d73fa26
SHA1 a607daf31888397127bb131919487c86f6eead98
SHA512 26bfcb8283340fd7d44745dd9ef65c5e362301e354cfb8c5c0ff87e61c8167b3c24f6ec5fb76f28a14a03f0419943967bf56f9e79c40757bda1262bb585fdf89
SSDEEP 24576:GZM3zFVSOU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GZM3zf4LNiXicJFFRGNzj3
TLSH
T1E7750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f4addca3925258786902544022f4f3e18cfdf4bc2e80e29474e7548c02314f0a
MD5 169c6a6d8297866e8b0a0bc3fa3a15a4
SHA1 51ff55748617a5e9cd86488dc193f92e6ffea4aa
SHA512 2dc82ae08aa4cecd454068de53b84e697acdbf6218def2b7baf69c53bf7e450cda437ebdc5fb7498c2b5df6fc70de88c5412f80be6db9da50b97e1054952fff9
SSDEEP 12288:nBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D3548955B1EAFC003D86764428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f62582e9985cab3bfefa62d47f93e63b196957054418d8f42a4b28a8bd8f4e75
MD5 0c3c4f5fe3551bd47348ebb1dae5fd04
SHA1 25ded77dbdc80eadda9b78ca5082b6a55b0a7df8
SHA512 e0f5cc56e627fecc462ca4e3a1d8e57c3d4e95dc95704ec56de8887a1f2fcf4d179ac4edd793edee822518f59f7f8215c28695ec6910e5aaed5954df67aa005b
SSDEEP 12288:kliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1825523D3548955B1EABC003986754428F5881E2DEB5619E3E2083E1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f3b2d470618cdcd33201e1694f5dda9dbc15f692ed73b114955956487918f4e7
MD5 96b209ef7ba553cf8e4491a0f32f04f8
SHA1 75e71953eb79b83e220581b822ee3ceee3f1f2f4
SHA512 53afeba6e4f9c18be84055af2b27b2beb191981133b78b4fa79fe7138fd69ab0081cddd4f29a854592ce02c46820572078dd970cd9b335cf6667b869ef01e164
SSDEEP 24576:QzyQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q/LNiXicJFFRGNzj3
TLSH
T154650157629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3752883e83c50c23ad078c2547b45b80fb6082f1e3a9d98ca86925b53b1916d0
MD5 def2c6b4ceaaa5c6b6d99746706c8a0a
SHA1 3d601412d2feaf791465352ced1ef4b68e0d6671
SHA512 abd86efaa4ef061ff85dd58f7a2c1ecbd2dd043e138b30f8d2b61ada4518e1040b333a53a75bc15452eebe2fdb354f67200b837a277528b38608116e2dda3e2b
SSDEEP 12288:MBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D3548955B1EABC003986764428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 524cee0edf9d7098fa589039fd4ad8babda2e3124b04ef7de83541f7ae6f5e62
MD5 e39ad7080af89f715b6fc995ebc872fc
SHA1 31fd6fd4d07cd8407a0400e4fa9dbc8e08956b78
SHA512 541d16a3a2b4d5627e80371e50142db5699202d1aaaead01dde4b1c3fa602b0561f24e71af30927d0132ee5e54bf3ea8eba414e6a2d4a263f0f504a38c1057aa
SSDEEP 12288:EBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Et/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B35523D3548955B1EAFC003D86764428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 47c7a89c1e5a1223f2f60e1f8ef4e24ea767b35117a36341509d299769afd39c
MD5 c5ae7f9bd87ca0dfccbbef0c34a77793
SHA1 75d4a1f380fccd35cafa5453876e4978c13e14e9
SHA512 f10e9643c499e209f794a3aad0e20ccc0ffc736efed4295b8b4b9e91f22c8f73d15343f41cb862fc23b7030b607c6e9a501d646c54fee10822a71d6402143c35
SSDEEP 24576:LzyQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L/LNiXicJFFRGNzj3
TLSH
T1C7650157629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f6623780ea45cac5eb244a649c91095709215a2420d74c91768bad5c7f6f8ba1
MD5 5083554f08ea419a4b9ad3b30da08283
SHA1 9b4371eea68b1d4236ab0cdb4390b3ab72e5181a
SHA512 ef6d871ae65d88b34ca4394e6b039bd49cdd918a23b56ed99fee499c754cc458a3f8c87a351eb8eeef8407380ac9901fb141fae5db0d093ebe5151a6058e5080
SSDEEP 24576:HT8aLl3z0zDe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HT7Llj3LNiXicJFFRGNzj3
TLSH
T1D47502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f2fb70740eb8fc77f3bbc2797b64822b65da5b66c03f58624587b50205dac3cd
MD5 72ac6d2629cf57950da224f87d2858fd
SHA1 a08b3c23876b92ed045bde6138931cd0f8d2ae46
SHA512 e6d11fac09fb46cac74d82b2b92a7058eab91fc71ba42233c37d51c0e2cd17ff4c9c314e7478f251fff662df0dfbeeb97202eec96dcce87c9c03286f0308979f
SSDEEP 24576:K3rd9CHKy7GZy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:srd9CHKya4LNiXicJFFRGNzj3
TLSH
T18C85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0a7d3c84b6bb380f4cb2892c5ba7cf94e24a1d1869584227be694f84bc95bd5d
MD5 508b2652462d2b4ccca6f4e061e10491
SHA1 3400b1e8e51f401c5eb3be5821a8cdb8da8cc54a
SHA512 b7f5cc4256d960dabcbfd76d1b6c731bab1da8cd9ba750c7d461f4b1597d160523f0f38ab8f277e10c83332a1f273e8d5bac65b5e648335fe0a7bc8233b5b646
SSDEEP 12288:rEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1315523D2548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f470c2a6deea4c0df2a04fef5105492ad021bf1a69f1b718f21a3232153675b7
MD5 343cec9f4738c55a51dfe3b23727f795
SHA1 af8d4a0ef46949fe0aa9f650494e3c6c1a4ea64d
SHA512 d3fff8a187ee67bcade2eeb4e062d35df330942c5e2f9057fe18bce081f8d172674cd194acc177785415adf6da22714a60d5de5f501c3147a96846ad778a613a
SSDEEP 12288:CGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B85523D2558955B1F6BC003986764428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 dc508a6912b1c6a0152b24ec17cfc2ff6dcd2472ea5a5800c80bf6f53649fe41
MD5 d2e8cc8efca070efca41fd5869423264
SHA1 7115cd8adcf8aa67c611ddc95b44004ef23c276d
SHA512 758a672c38361b8c8ecc9d4c6d6387d214374c0e8e0e27d7e06e683d9395e907c491f5824a456be3c11be7debf8752b08154c879699e0d25e0eea730a1fe0dba
SSDEEP 12288:QbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18E5523D3548955B1EAFC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 456704242b41a0698c0c4c96853b7e742f3f48eba5aea1f61b5059828c1d771c
MD5 c0585ae44d500b21a7e48437079cb362
SHA1 9be108eb84595477da3547579dbc401153f44b29
SHA512 c371a011fedcaa110277f66b23ee9bf0d5456fe8f6feea27c65fcf9728ada5d0964d950083ce1e9f9b0e8365c1976ef9de2de30cf22f3727f66db84a9eb46c9b
SSDEEP 12288:epsfRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C165F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e4e060bc2de1121d2f539d7290f60994b8a1f960a80bb9698bf2fdfb56d69092
MD5 70c90fd503b5d7b5d7418464c5043faf
SHA1 d474f519bd8b5674541fd83a1fb01bef91b23b06
SHA512 01588bfc85c50276dc66fe60ab1c32cc30bebc4a25e066dadd576868712301a3d1222913a0b7aeb064e72df3e8d9077b0a8bbdc051e4b316b1e8692e750fd026
SSDEEP 12288:eXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ej/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11A552392528C59A1FAFD1039867A9434B14C7E2C9F1598D3E2043A5EA238FDBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a401184bf64cf99acb047ed7797933aecb0965e612e50147ae32bc19beb8ee52
MD5 692c035d747b284abf63130467dc9d0a
SHA1 c0fea4bffe1cc2f5c5681c7cdca1f35e33daa093
SHA512 d914b33192b368f76a5b06428adc8968e606dba47cb52002ab17fd8c5d1dc19d4cf9a8399a02142e048e2d6de9b63dc399f445614c662a15a924d35898f6a8d5
SSDEEP 49152:gRZwQCyiHiQEaaPnMsLNiXicJFFRGNzj3:u9xvPR7wRGpj3
TLSH
T14B85B01E62DC46A5E0BAD278CDA74407E6B27816473197CF1290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 63af9f8627b92d7a0041e0eb5200647cb52fcc3137030dabc27ef897a4a5b39a
MD5 aba4f5c0a3918f22b7cad7365a0fc150
SHA1 d31f90a0c8c42330394d03cd31213301321849af
SHA512 29a8aa3470509543347facfe3a411b1599df6493e170f1579bfde05b6bb215434ae87f87fea52b462fad92b47fe50c5c87e8a59d273ee4357112ad716890ffc7
SSDEEP 24576:QbxA1UGg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QbxA1UnLNiXicJFFRGNzj3
TLSH
T1D355126E12DC14F0F5B9903D89A68005E3317C2A572197EF6180927E4F3BFE99E39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b5a53badd89ade9ab23972478d6fca0f39eb996aef0f9b7ed5b5525ef41fd9ac
MD5 9a28e2e94c5795831b4b89d7845cbfb2
SHA1 d7ccec7583cc0b8ffbb7578425f154a4f331ce9f
SHA512 9c862e16952053daaf16bed2ec92a63c60a6d1c04c8eb07309c959da16c257558a66ee241515b3d11ea7e25ba17933c61375e8d6df3703a435b0b97b799f54f6
SSDEEP 24576:ujsmP0yHaqrVqHra44KDzMsrnK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ujRP0yHfVqzlAsrnKLNiXicJFFRGNzj3
TLSH
T1B645AF2EF2B910B9D4AAD136454107B5FB71782D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 fb3753c0f2a2be7f67d4064737e5d27c3cd83706b610d4c7bf2ab70d4a0c43a2
MD5 fdbf9891cde8dc871cf8621a11e5c353
SHA1 29ebd7d099346ff0fd72b52e35f917900857ce13
SHA512 4b4cfc2494c677d546fb309d0f9e6874a62a7aaec04f20ff28d8a5dec1375a47fbc56a46b1b47071e2f94ad1e10d71bf9e2bd551af1010effd563bc793462f0f
SSDEEP 12288:UpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D2518955B1FAFD003D867A4428B1886F2C9B2619E3E1543E1E927CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 69e63d2724854bffb2c44c84741ea6ca9f5b55d0e7c2da7a77592ee1c7e4a153
MD5 44367bc2bda9a44a599066e811c4573c
SHA1 f00ecadd703f1214ed2d69a7f5a97b7f1e889c01
SHA512 b160075c2128f6fc620065b022c1af7c25768ead5170bc814628fecce41051389c0a5502afe33c6c74d1ff73df8dc64d94f55978ab325dd27604234e4f60beae
SSDEEP 24576:TALBUTv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TALBUbLNiXicJFFRGNzj3
TLSH
T147750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 44df87707873233b405f17b45cd348cc52640ac1b84980b2c761bf7a9ff3aae8
MD5 8fbfee43f11040a8a0c7adb11cec1e48
SHA1 ada6f6eb076936eeb36220447973d568a8dcdb6e
SHA512 8eb486c33785f039364fdbe82fca1d212ffa689384a52805ab04882ccbbcf3b7d6768706216a2857cd80e8c98c1f20002e9f4dec56436f81ad3079fd66acb14a
SSDEEP 24576:RfYNHm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RfYtmLNiXicJFFRGNzj3
TLSH
T18165F12F629D18E4E57BA13DCA828109F2727C66171192DF01A0827E1F27FE9BD3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b9f7f98eb622281002a28adb80cb3ad34b246807d0fb23f0e06c3c887d532c0a
MD5 8c2b7d699095b3d7376d383c6084bf68
SHA1 be6783bdc4a72fb5beb15b128e12a27144c1f377
SHA512 9055fb4d1a7880fe9aca1c37bff65e116b3f1412c059a61746b05df0bbaa0fc525bfc4234dcbb193705a11b7958ed02e9f31bc2cc16468e20ecb67034280dcfe
SSDEEP 24576:mnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKC:mnXoJJYH84VVS6AmETJas+cHBjSSKHPZ
TLSH
T1DC65BFAEA2BC04E8D5BBD17DC5C24506F5B178651331C6CF026082BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 707119fd041751efe94d8abb3531a56eb8c8cf5a2ad1da87b42be983ecb76f31
MD5 47982a515cb5bf2392bf5775753e3982
SHA1 e43946116bf5e4d9eabad8c39f747ed0a26404bd
SHA512 520410ebea976618e99798ba5961bbc3d2234af1d1cf1b903ea81e5e8ffe94f34cfe5b6d7b4e768ffa634498bfc9804af05f0bb89e06aa83446ce422b8c30cf3
SSDEEP 49152:GDLL9TuJ0M/TYW2PVLNiXicJFFRGNzj3:Fe7wRGpj3
TLSH
T1FE858D5EA2EC42D4E4BBD6BD85B79046FAB2B855173081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 715e3fdae63e29410fbf1f0ad4d406ffce1f118031cee9156e01f698d079414c
MD5 addea11543ffbd90bf9457ad52ee50d5
SHA1 ea92f9d7d1758cef9058a1a460147157e1a5a5e3
SHA512 2c325d689731cdd25935f24f037f846672ef0425422df5d77221826833bc0192977a862db74bc55a815066893c101fe6b1b1955d68bfb15365f8726b6734bd21
SSDEEP 24576:megJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wv/TwSfVcYG3K/cJHlnFR+IGNe8j3w:mngOJOmPOHkvLNiXicJFFRGNzj3
TLSH
T1F355CF3FA7BC15D5E07EC17D8A968816F6B0782603255ACF0160827E5F2BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 39dfae71bd2ad209a8056015217f73b815453261af84f7391eb857c6b144f959
MD5 a814c5da231003cb0129028699c8f30a
SHA1 b4857a7cb38cece848387d0f6150402a580c1f00
SHA512 d787ff9c71888a8ad455c739b97fbe85951d66660b0f5bbd6dd5f1012ed8b47ad62028c6772ef309824097590e86f43dacedec876743e06ec07ac0be0c73259d
SSDEEP 24576:OLJnJiTk3R3waE4JrOV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLJnJK8R304laLNiXicJFFRGNzj3
TLSH
T12E75E03DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2d045317dc8206b844a8454d0a0a9ec28d36dd4a19d97ad572cfad4520202d95
MD5 b0d90a39c47d752f05cf4ef098fc861e
SHA1 6d5b7f9e312ab3ab700732764b520c9e60466377
SHA512 394a41895d8ede89d5f83c3544e21ae7f21c9e8e2da3da4230aad39a7201dcb3730c28d11b11dc77010df4a0e68d3f3043034401d2b28b79f773e4390f6da515
SSDEEP 49152:i9GqCzDScAZmlvTcFg8Ph6ZLNiXicJFFRGNzj3:8G7wRGpj3
TLSH
T159955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5a9c2ee0cb3879cc400eacbaf1429fbecb71d3960cc67dba27e9ecc9615bb161
MD5 42d0183d2f4c5eacda9505777cdf78ba
SHA1 abf62ac9b22f5f750d7d5e1393852bd27ff3ab1f
SHA512 c2f2790066b6ee73b3f2b8e46b532e1cfda49a977f27e92f46d7b839feb94b202e38788516f625880cb141afbcbcee0102e9ffe579e3cad3a42732606a3009f7
SSDEEP 24576:NlYJeXm5jUuEc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NlYJeXmRUuEcLNiXicJFFRGNzj3
TLSH
T1ED55129E268C30F1E27E403D85A24414E361B879571217FF91E0A67E8F3AFE65F38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 017c381b154171c7681ffb4ae8775dd36be46391fbd1e130fab3a5d1a488eb9b
MD5 e92a748ee6b5c9917812a90de5901f46
SHA1 12d5aa331a6371a5f6f606d964922803a8ae82d6
SHA512 3c989e5b674d10380b50aa98832af11cb62417210edf4e660f43baa867322133ac37ffc9d37585044c89b4b9fc58c1c910d29a42c2d554ddda1833e84d870ef8
SSDEEP 24576:wVtyq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wVtRLNiXicJFFRGNzj3
TLSH
T13265124562C461E4EABD053CCA734064EA647C249F2147EF9190BA3F6B36BD5EE34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 0d404e3f6686327505cd9c7027e407ce42e678c59152a69ea6e2587a52e5728c
MD5 c0ffa6e6ed1c1dfbc3c8b651307f9c6a
SHA1 4befd8ed6e4157c14b4b97b9cc0cdcc75523146f
SHA512 fa8e127cdb7e8bf9178fc41ecee7fb8a5b64a1929d63446575e4ca99a34e1ef59d3c27d14c8f0b7eeec9d7cde36241309ebef0583c6a75346fd19428efbb315a
SSDEEP 12288:6P7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CC5523DA018965B1EABD003D86364424B1883E3C9B2528F7A194793ED37CFDBCF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7d1deab4dc21f60898d36a66d14e0263e5070603aab2e16104aefba9da76f8e8
MD5 71a07f2f2f2b321d1acf7dd21801c849
SHA1 ca03dfeae1a45c21428571602adac8ffa92ad884
SHA512 3a1c293fa040d3c73035870b58c7257b688f2e22515b827cddec4dce0e1c1a157f1514eab13b203d19f338a80aa0374b4689fa50c73c9c0a4e7b3218130e547e
SSDEEP 24576:jC+TyQIu93VAumZr7jm0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j/TfIq+Y0LNiXicJFFRGNzj3
TLSH
T130558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1d69f54efb99520672827758b38e6f5705629f42f29477260d1c549e565fee0c
MD5 2c26ebb9355d8c915f4b66c40cc75be1
SHA1 fd868321dd5da0cafd705a15aab536553dd9e912
SHA512 1882f31dcc746e20cc9e4c86741aaaaeb93231b4313786721730e7ade8717cc1618add935b9526ef18a3d08b8039511a6c59299f1c6e23d7f617abb7af83fcd4
SSDEEP 24576:OLQikZr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UQikNLNiXicJFFRGNzj3
TLSH
T1CF65F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290C77E4B7BAEABE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 31c45d97dfbd9b330eedbe9ebf75c108a5807aa4af24a7d78fc9fa279e5451d2
MD5 96bc91f8a15989e23bf3b1e0600cb387
SHA1 e735ed610a718d992a8acf9e91fd775ef8a06328
SHA512 70c896811a90295fbaadb5093d460bcaca8bad7ad0020be8c8c4ee0d9167a55362083a1295cf584e13c2feda590cccaa90fc1a77b013a562a48a5f85bbbf7460
SSDEEP 49152:fpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPqLNiXicJFc:EpC7b4+80GTkx7wRGpj3
TLSH
T15AA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f2db953445cc0b932e22f2c115b508600523d8620165e6d05880c33c3ac2985f
MD5 37ad2faa9a2fcc561b26f382aefbd8dd
SHA1 20307fa268b7b42772cbcede68401b3a8ae740a4
SHA512 c08f2adbc8e228effd8e9662b34be271a3f9fd66f00220859f4b39339e5ac1bc5fbfd17102cbd9d20e786475ddab61b6f4610f0799142114910c78bf5b0d377e
SSDEEP 24576:OSAwJPE1IDAo+4Kt+l4413lUQF/TwSfVcYG3K/cJHlnFR+IGNe8j3Izx:OqPCIo4Kol4jQFLNiXicJFFRGNzj3W
TLSH
T1FD55B02AA7F956F4E17AC774C663C511FB727822133163CF9290913E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/636-323-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/636-268-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/832-409-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/832-275-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/1080-64-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1080-60-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1080-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1080-54-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1824-297-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1824-299-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1824-291-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1824-413-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1848-320-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1848-418-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1956-407-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1956-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1956-335-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1956-329-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1956-375-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1956-391-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1956-420-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2264-286-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2264-412-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2264-278-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/2264-284-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/2448-227-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2448-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3008-25-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3008-16-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3008-24-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3300-315-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3300-417-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3448-74-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3448-68-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3448-197-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3528-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3528-228-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3528-40-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3528-35-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3596-302-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/3596-415-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/3768-324-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/3768-419-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/4176-235-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4176-238-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4400-314-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4400-245-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4400-244-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4400-251-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4424-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4424-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4424-196-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4428-10-0x0000000140000000-0x00000001403AD000-memory.dmp

Download

memory/4428-30-0x0000000140000000-0x00000001403AD000-memory.dmp

Download

memory/4428-6-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4428-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4520-327-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4520-271-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4520-414-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4524-311-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4524-416-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4584-305-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4584-307-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4632-429-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-436-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-445-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-448-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-446-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-447-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-423-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-424-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-425-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-428-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-427-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-426-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-435-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-441-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-437-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-440-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-434-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-433-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-432-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-431-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-430-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-450-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-455-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-439-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-438-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-442-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-444-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-443-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-449-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-454-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-453-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-452-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-451-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-460-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-461-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-459-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-458-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-457-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4632-456-0x000001C11BCF0000-0x000001C11BD00000-memory.dmp

Download

memory/4896-310-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4896-240-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5032-255-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5032-256-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/5032-263-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/5032-319-0x0000000000400000-0x00000000005EE000-memory.dmp

Download