76b5098a64959a529ae906dfb2b80618f48c76b0b2da7d675313c45550e634da

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe
Size 1.2MB
Sample260922-pd7saadh94
SHA256 76b5098a64959a529ae906dfb2b80618f48c76b0b2da7d675313c45550e634da
MD5 794101ce133ded63af4aed32abec4050
SHA1 1dc3ebdf5ae914439bb97d9bcc614880c27722dc
SHA512 08b267210de01b57f4ed3efeec309ffec1624a617a770699066800370dda00dba16d8a5fbc505adba70ca542dfed162b63ce9c55ed846061bee4dda8d055df6d
SSDEEP 24576:rDIiukOiFOPfepJ1PeCtsO8e7zYTiGpxAoYmK9jSjwp:ngAPeQJmiGpP5K9mM
TLSH
T12C459C4263ED02E4F1F7AB349972414ADB72BC625B35C2CF0254566E1E73AD18D3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4888	alg.exe
4160	DiagnosticsHub.StandardCollector.Service.exe
4984	elevation_service.exe
3808	elevation_service.exe
2860	maintenanceservice.exe
4480	OSE.EXE
3612	fxssvc.exe
4312	msdtc.exe
4740	PerceptionSimulationService.exe
2556	perfhost.exe
4156	locator.exe
3176	SensorDataService.exe
4360	snmptrap.exe
4932	spectrum.exe
1512	ssh-agent.exe
5032	TieringEngineService.exe
212	AgentService.exe
4724	vds.exe
2384	vssvc.exe
4968	wbengine.exe
4756	WmiApSrv.exe
4172	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f311d4b660f3a3fa.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\SaveDismount.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\SaveDismount.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4fd60148c4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000047376148c4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003232f7148c4add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004edba2158c4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c29218158c4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082636f148c4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4160	DiagnosticsHub.StandardCollector.Service.exe
4160	DiagnosticsHub.StandardCollector.Service.exe
4160	DiagnosticsHub.StandardCollector.Service.exe
4160	DiagnosticsHub.StandardCollector.Service.exe
4160	DiagnosticsHub.StandardCollector.Service.exe
4160	DiagnosticsHub.StandardCollector.Service.exe
4160	DiagnosticsHub.StandardCollector.Service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe
4984	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3160	2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4160	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4984	elevation_service.exe
Token: SeAuditPrivilege	3612	fxssvc.exe
Token: SeRestorePrivilege	5032	TieringEngineService.exe
Token: SeManageVolumePrivilege	5032	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	212	AgentService.exe
Token: SeBackupPrivilege	2384	vssvc.exe
Token: SeRestorePrivilege	2384	vssvc.exe
Token: SeAuditPrivilege	2384	vssvc.exe
Token: SeBackupPrivilege	4968	wbengine.exe
Token: SeRestorePrivilege	4968	wbengine.exe
Token: SeSecurityPrivilege	4968	wbengine.exe
Token: 33	4172	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeDebugPrivilege	4984	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3160	2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe
3160	2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe
3160	2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4428	4172	SearchIndexer.exe	132
PID 4172 wrote to memory of 1652	4172	SearchIndexer.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_794101ce133ded63af4aed32abec4050_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3160

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3808

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2860

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1036

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4312

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3176

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4360

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4932

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4956

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4428
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0554ac151d969d273460ba16056a6d1ec8cf24104316c8998e773cf38557f389
MD5 c4a7eae984f9ad9bdd71f9324d9b5c27
SHA1 93c5e060104c415eb737d916c23e7237f2533ba0
SHA512 5aff889776c8ed64c2ecfbf8bcd9d8ebad3ff86f5fdd0e6b4e2336bf3dfdcecf9e8580f9b3eb5d9c686bfdd4d27cdf07136c8d2e4129d89212c88da9a06a2040
SSDEEP 49152:ib+632BuPkFKRrdE6ohrstBhuXjfS4LWxnCiGpP5K9mM:E3q60jBd2n
TLSH
T10FD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 c2e7e07e0c3bae2bb24e3effe315e83b5d3cfa34e915fc79d8e0a81feda7a42a
MD5 35d852c8394497ed72f96cbe9bf4992b
SHA1 f6b34a4b518ec7744f33fe06a118842a5ae0b806
SHA512 974649ba1ed487613196e9b072efc44468ea0f859ca4310c2deb36b9de5246914b8e23e3f446af4c4efed38b3bfd40b40d4453675388a6bcadb3c8ec91d2f64e
SSDEEP 12288:F1XLsswWkxy2lRq2czAn4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:LXYfDtczAniGpxAoYmK9jSjwp
TLSH
T10575012573D10CF8ED678178DCA28402E632BC554760E79B03E89A6A5F337D86D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 7b31815618ed5ad37c9e011f6bc36ba33d089864951a3c9238fa1159d268ad57
MD5 29f95056315175b29b25a0b716a3cb20
SHA1 54f46791e554b2c1928e140d1ff4d74df056673b
SHA512 2c299661452e70fb1292c0a66c700ad11bd644ae67be6adb7149b0dd257732c2a0176862360a5ab04fdb175e85b1a27c8fed3001b43f2fe05a55d2a4c0e3e93c
SSDEEP 12288:rXZNYVLeyUji0h90ZD0wxpGZIVuNrHsK4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zp5:t0Le5ji0hmxKrMKiGpxAoYmK9jSjwp
TLSH
T16895AE26F6748731D073C0B9C5D2A68EE97134825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2fbd66b29b1dbbe1e70b3f7fff7df2f540973fb1fab2ad6bbaeb3c9ae5f10677
MD5 ce84df880b2caf83db0fc61d7de4ce2a
SHA1 072800f4f38ddabbffc9204f9c6280d4abaec1f9
SHA512 f5403a0bf8a332ca4f39a6b9faf852a66f30fdfaba1870209ca0e05ab3531a5eb9c5105821fceb48cf29fca9ef1d072eec32be94f1bc92a2071fe802ef42c524
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWr6q8wyuwiGpxAoYmK9jSjwp:K/ezSC6vUzPviHjyliGpP5K9mM
TLSH
T1D1756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4c91d4c0db233b8abde2f32b875e620f9383b1efba1516cda7ff21868afec06b
MD5 4c378f3e9b12f34112f25f05e71d8daf
SHA1 0830e1863278d917bff61e82b9eb0047beec3f91
SHA512 68c9f108c7dcfadba32425a5f77ff185ee933f85e11c7ee73a004cbea329d5da295f59016d0844508747f3da03fdcd2afecae376f970a26885c926c8f0d9bf88
SSDEEP 12288:oVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98r4fPt6tpm+OXhWS6rVoVlK5KZmf:oVbqPb88hv/l+briGpxAoYmK9jSjwp
TLSH
T11C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 8b019323575ee0d0370f827d36b1e9ec65ff6d205d6c0e2b196bd5648c4c6e0d
MD5 141ba39a378974ad18280695ee5cbb90
SHA1 e4fcd896861cd81086ac42e144270c7fb161dd20
SHA512 01620d0312fe72e51b63f157a468827b5592275920aa3a4f516ad3e608a883a13d202836d680c38a2a812cc5bae7184175fccb39e7433dfdb097edf2feb59cd3
SSDEEP 12288:4/u4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:4/uiGpxAoYmK9jSjwp
TLSH
T18A65232363871CE4DF6925B0F8E5B4C68254FE74A9504933125BBFDFD832A61F4A188E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 cad4b45e483709775715f06d28a18fc7a937952706c49ba15ee25757ce35d7b3
MD5 5b68fa8cc603dd815c8e234d27aa92a1
SHA1 ed4ee68ebc9cdc3610ee1415fff8e86f0a68b0ff
SHA512 f7a5d8cbbe4f3c6cc8ea3c303cae2c33ad8b0703758b0b5d65aaaeeb412235cdd64959b377e47fd0c24c7cac447341391be7ecb9d9771dd6c20bd0331f3e3194
SSDEEP 12288:reBNUbTVO86Uz4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:rJIUziGpxAoYmK9jSjwp
TLSH
T10575CF3BAE28FCE2C27E9DB86A918640D77278304B61A3CBD165C30EDE235E15D75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b8d476d7d0ebd4f840a674dd9dda91cffe7170abe4d3c5698ac1b31c73f86326
MD5 e94d22ca7df4d84af0b1f5bd46a113de
SHA1 25eb0537f874bdbeae6a18b725534b4d04e90ac9
SHA512 0ecc50d44dd0f22dd32f0a1b8a3fcd9d97511e9f95269298ad821e11edf329ee3c7af3031259e36c257cbeda0ebd86d338e99397003e455c98f5b3910339a668
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THG:4QvGAdlCEL8c/RRNw5C22n
TLSH
T149267C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 cb284679eccbada3fe8293d36604a374cc1739feafc2b50bf0d878b271d29aa6
MD5 cf509f4bac7edd35a20bcb816f41c995
SHA1 eddc206be6215d128b4c0b68afd812568f205585
SHA512 58bbeab22449473a9e580588af52062069f0da23142e2441f0ef7250cc7d7747b6d93d807370b28fb4dd09478b1f984320746aa32b0933005e97914cc07cde13
SSDEEP 12288:OAwSfxL/2Dc3uDLLmt0LDQewsAj54fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoS1:zbewsAj5iGpxAoYmK9jSjwp
TLSH
T1AF85E031FA75E436C77F0DB12B26D716542CBE204B5119C3E3A89E9E99302D22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3b32cffe3f815d327c171da1f777a922f5ae06573276a601556bcd5632607372
MD5 a1e413bb4b7b54eb6a02758731b9a16f
SHA1 5f976d6af0fbc1e3eecb41dfb963bbad40ac3bed
SHA512 fa76776883a09f9a6628c350e9637e8c83759616728b55af42a7485332e494599e8c4863f884feffad699b5eda9bc36c642360541be121560ffb75ad40e466b2
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHP:LUEtQevvqc2W1cpV2RI32P
TLSH
T17A474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8cfb6bf0c7fd6043235bd27c12dc56ff8c9856cf155efd73b1059a19ca715ffe
MD5 cc3c316f368e88f326878d44d2b9e25f
SHA1 958a9155e261cdd7726e5cf8bc8744347d13f4b6
SHA512 fa8715253ddf82f49f73b83fc1a7607854bd633169c392e4706f3cff47e781587633087e4fe7f9bf2d4afabda06dd7e9dcc2739159d18d2f79d7a6d46ea5f37c
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/zZiGpP5K9mM:CoqtVjnma2n
TLSH
T1CCD58D0976B881E4D1F6C77896A2C647F37178154B309BEF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cf36cbde6fc726982fb0ba67fc949241a22bf898acb907e0a8f9fb805ff0ce8c
MD5 daf8094a1f2c055cb67fa0978e5f153f
SHA1 3344a8eb74f391fbf854885a49c687a3dc9ae177
SHA512 85ea2bee34676e75655d65633930a0dbb8072ef88186acb3dcc01c19c072d62282114aed6f4b016c5a6d6fc012b52998ff0441dd1a735306d6a60e64b905fa5d
SSDEEP 24576:LAhGL2IFoiwtA5l7S53ciGpxAoYmK9jSjwp:LAM1Foiq5siGpP5K9mM
TLSH
T11D35AE81E7F955D4F5B3AAB8A9B69071EA76BCA65E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 8423fb0f0d6f4b4cf8003c42f4fae8ae8f4adb317ab91c0f1c1422cac3cdbdc0
MD5 5e85d1cfbe89a6d6cc17507fbe441fda
SHA1 d3d32418839927770b975c6d97015194cbe33cdb
SHA512 87d394dc1d8f23d924bae35b4ccddaf757e501fe98450d849b7b717c0f1092222f7044a64bf5402d5f2c5cb119e7862178ada9005af72377d0eaa1e6435fef57
SSDEEP 12288:gmw5HEjsChNjBFgl0WDm+CQ4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:9wuWOWFiGpxAoYmK9jSjwp
TLSH
T1A875F14673A51CF9E9675634C597D036E7B2BC112A21CB2F1360CA5BAF33361BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 e683197a908d8bd71e93211016d840724f793c27cf007501ef0e3dae2110fc4c
MD5 e6c4035916aa2a2ab0ac03c1fc761b9b
SHA1 931328acf8f9f2f617923ee73c01a1137e226508
SHA512 535678d6e7e502d7036f0bf37987ed25acec57afc7bd3a4c629cecebe80baa82a356b84c84a9868a54df5d0f648713fcf0c0758861540a3e51ec1a112e73462c
SSDEEP 12288:lLZ1Iyp4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:BZuyiGpxAoYmK9jSjwp
TLSH
T15465121233D624F8D6A75174E8E19446C371BC66673043DF122A9BAF6E33BD26C35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 853e979bfef5e3f1b2b02b40cdc292ed0ab40686231ae706049a447d58d7dfcc
MD5 3011fa34abb52f075416a1d5227f522a
SHA1 d316fbcce5e4dac5a4e4a2601e2d337794480cf4
SHA512 af4c056a998e83eb9ce86c6e09f4512a90c899a4a5b4de323a72042494ff106eeb2c3b0f5b60ee46303891d6d92e28010b9b01b49966d589fb2f80b8700b0e58
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UK:cQRQyi36YOcPhLvw2gAf+PN3J2n
TLSH
T172667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 669c1b0b53288345965613dee923f5bbd61f5dd0fd6756a071ca89ed1485a277
MD5 df10ca89a0bd015917d57e6acf18cec9
SHA1 bb403904e76e670dcd8f5e63a138f842bf37081b
SHA512 194c7bacbe7c0b0a0dcea2221d7949482997d08b2f60fedfee363c45f5b1acb6ac4f028faac5508d7aa90146ba0dbbe8640e90efc8f95a85e36c8e82e9ddad04
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UK:WQRQyi36YOcPhLvw2gAf+PN3J2n
TLSH
T105667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 13bee027c182384046b633d00f0d846063e56bade3f50b95cc42a006dabe1d76
MD5 a5bbc47d7c79e68b6553496bfed563af
SHA1 77100c6d71782f90c9215ccc3830d861665d1092
SHA512 f16793ae91ad497a30cbc10d4a6ffe9a40d6f21841d0590f4279fef396c43d8fe2973bccd6257462f7bf209c003b580d695066dc662573a647a645d7a9196631
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0CiGpxAoYmK9jSjY:q68Qg55nhceWu7PNU3/JiGpP5K9mM
TLSH
T1CEB55933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8115720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c8d37310f16598e50d36cf472f1f45067c8f3e5f2188d589b98d492812b3353a
MD5 f293c1f0c279c4004c678f54961fb195
SHA1 ed493e6f178032c1210390d5c7c2ee2a7c74538b
SHA512 10d66b5e39c326c9fb41eb4a48ef6e35a20d527950071beb2fa21959585ceabe448ca1aca4d46130c5529faea3b218a6c7d70f784f215bb502bcf652110a8e9c
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99k:ky5112gYy5azzVva69nLKnhZ42n
TLSH
T17A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9d1ce972c8fa6594a83e3feef9f3d6a3371c8a48d01e0d8fd442fc8949a5b921
MD5 96949cfbf312ce4628826471dd4e365c
SHA1 175a78b8ef1b805a9dc257ba0e3cc09b5fdc8e18
SHA512 8e835b057075a68243f782d81c8e16447a4137ed737a0cd9cf293923a0af31f2321e9ccdd8e5fb6db058ce71a2670c39ffbd793ad8845ab737dda3a27f7c2ce6
SSDEEP 49152:xB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl3iGpP5K9mM:nu6JmUxd2dR2n
TLSH
T125D59E13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 57a96a4a725d6bff8f7348d4edf9e9dc27524d14f73995d181910ba91a2cbc80
MD5 b9277966e2cdb6987490df16d30e22a1
SHA1 fafdcd2230b363683d7b753da27cdb4e6328e48f
SHA512 bfeec930b535396dc2da8a641f5526df31b730f2a65c57c112ab3c98d83a9c8205eb9a6f33470c283c8e53109a5501d393301443a25f9286b306ccc1cdca77e3
SSDEEP 49152:s1hpsNoJpF1A6BU44CwH7R4xTiGpP5K9mM:smifPkRa2n
TLSH
T107B5AE13F2D900E8D06DD17897569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aae5e0e9bca4a0ebd413cf86f499992dd9772ea1d83a7e7dbce418abed1f9c82
MD5 9075e6cd4af913ae86c8960f225995de
SHA1 2d32b118b9487e750ef18295b2465feeaa970c62
SHA512 e72b6f720c2c2e1ab0e1e1f7b43f18ff6fd79bb048d4fa6e08866250a45168f6e8bab4b61e1633111e130b4cd0b794ced5713dab9104d1290d6547e2c16d387b
SSDEEP 49152:CSuZQIY0Be2KNRVtOnks6NMHqyiGpP5K9mM:c5dKvi61E2n
TLSH
T13EC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a593a034bbc8f8841c6ea9cf6e2a907bb703a8dad0b6f4ee25a0db8a4f0414fd
MD5 11b309fe594f297395ae25b78795f56d
SHA1 8c744907bf153869ae6dc7a4a13e6cd1faf80fed
SHA512 7c7edf6b3f4ef141fcf8f01e57aeb8902bdaea690286b70c039f4326151ad92752b67e8c4732316fb78555a535bc1389111c8b7ab2f138f3f4ebdb1d52668159
SSDEEP 49152:PhtSn8EApI0figXgiDn0AP5wniGpP5K9mM:eX2iyphu2n
TLSH
T15995BE13F2D900E8D05ED174C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 949cc357c9652a3f076aaf1badf8c70e8100ef99eef032cf879fbedb3bec95e1
MD5 2d156bf35a82b63b58bb9a012593278a
SHA1 65a63c82b0344181b5485b5e766668484a101c57
SHA512 0837e9823a6f221e12a3df6bc441bacb926c95882ed9760d95deec1a525642663c43b5d9dd74287143a2b6c4d8c165144edba8e7af31855fe6a8218b5c459a45
SSDEEP 12288:J24fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:J2iGpxAoYmK9jSjwp
TLSH
T16865232372970CE8DA1925F0F8D5A0C6C254BE7AB6500573225FBE9FE872B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 892c6db9e309c0d8314d21248debd36bf9c1b4be5384d9366b4396f2f0bc61ba
MD5 6facdd5ade5fae8b9dfd8383971e880f
SHA1 f6ca2cbd674f5e22af3c4cb4060bbff35a88dfc2
SHA512 95e6b214bfb1a718e93c47432bb1f7d04c1e775e1aec4b46ef611ac35a42c1389fa5327c344875324360638bbe97ebd8b608823f96f8501b27c65148a4f5e09f
SSDEEP 12288:Cd4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:CdiGpxAoYmK9jSjwp
TLSH
T18B65232372970CE8DA1925B0F8D5A0C6C254BF7AB9500573225FBE9FE872B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ce11353398194c09685a63b8ca20e53fd33051e6341ac3898d300fef3daeffa0
MD5 978d99661a207b8b9f45116b02b8d825
SHA1 7a4bcee5db6c86ba36faae057b134b4c60aa25c9
SHA512 a5846b2f13165e2a2e3279b0a84c305cc43101f318320ac3b880229aeca2e80040b78efd013a8cf7297e1cba4275dcdef1d5834d19c5b5ea00e0c872b250b516
SSDEEP 12288:x74fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:x7iGpxAoYmK9jSjwp
TLSH
T1DE65232372970CE8DA1925B0F8D5A0C6C254BE7AB9500573225FBE9FE873B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 513d9c0817f4c9a5becd27f676d80cdbcf6d2506fc7b5c3f36b570b1d69e0878
MD5 0cbd0d1fa0f36ce686be0de240e1b4f2
SHA1 eec38c9d5ca811e4eeaa365c3dd4cbed2a33d877
SHA512 4022cdf4f6ff7c3fbb8618e9e6e64d2c31eac96001e8c0b02dc69f89bcb9d8926a790fff6eec52ee289ed0de3fda1ab39aa58a3334d4606b547037ba936c777f
SSDEEP 12288:SV84fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:liGpxAoYmK9jSjwp
TLSH
T124652313339B0CD4D965A5B0F8A2A096C3B4BDB5B72046BB13076E9F9C727A17870C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9d0a367f35f41c30f7cbd9591c263a63c4c0e42d2a18737abc5b186505564fa1
MD5 9ac8b7c356f1dff5c814ef39000ec91b
SHA1 4f546cbb565df8a2d4989b564e40d992c5296523
SHA512 405805857fb33364eda489bf4327e5365fbd3200cd60ea112d037982e401274a72793631bc257567896469ee0a24266c8eef87bb2d36cc8920217c78b94f9c18
SSDEEP 12288:UU4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:UUiGpxAoYmK9jSjwp
TLSH
T14165232372970CE8DA1925B0F8D5A0C6C254BE7AB9500573225FBE9FE873B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 a13c9900cfdb94189a378f3c27d6fdf4c92ebb0ad33ee7196190e66a0bc06205
MD5 e4a105728ef2bfa9f61e0036c99bbc89
SHA1 2c20b8e82ebb13641fcd6594953114ed53b96f45
SHA512 ad66d18b9fc3817019e8faeb0017cd23b2fd51807b693be0806cc8ac94968f0d312566206974fd76d58bf2e20bc63e22cd5fc576c7823d4ddb37dc620eec8fdf
SSDEEP 12288:6h4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:6hiGpxAoYmK9jSjwp
TLSH
T11065232372970CE8DA1925B0F8D5A0C6C254BF7AB9500573225FBE9FE472B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 87b7a29833ed4ad8354b1fa3379dc7846b334a9d43cc2f9bf7fcdf8c1f396c23
MD5 1a6dfe174f17ff4b5294d4705f451883
SHA1 ea63898a453e2219c2503bd4c236172d8a0250db
SHA512 93a13207b343a72374d62b59d48832b165039a685ca88f1b9447be679f109689052a5eb4cd79b875576d592b6414293da2048323c18807196e2052f03ff9ed26
SSDEEP 12288:8V4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:8ViGpxAoYmK9jSjwp
TLSH
T10765232372970CE8DA1925B0F895A0C6C254BFBAB9504573225FBE9FE472A7174A0CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 88b277bf21ec47a7ad1c4d1498dc8186f9b147fcfb30eb15fa185af59a7d46cc
MD5 4bac46110a67fbeb5f8691059ec1ece9
SHA1 c48c311defed9ea64fd077f4148ca8353ee537e1
SHA512 adea4ea5197a438ddd21bfffee6d18d33042dddc44f81ce71ed639d32f6265f334e21cc6acc9caf0fa9010e8e092f340316ee05683a0a0fcf9b9bcb1cd63e066
SSDEEP 12288:BiZwbbzzFEoS2cPvy94fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:EZMvzFVSO9iGpxAoYmK9jSjwp
TLSH
T1AD750161B3911CF8EC678139CC559846D2B1BC6A1B60C61F03A93A6B5F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 ec2e00eb3f661d26b068fe80306da26e620a9695a1798ec061e0b0f12bdc8667
MD5 c5f726b8ad9a22a303905f409ceef5b2
SHA1 53f18464b648489797d5a53581851e3f43eb9495
SHA512 22709309951e2eba4bc5c5b02a8b65918c3469f3e48cda62c2cfd39e10fe52e7bf9ddb7fa76c7a234df1900a43fbe4a48c54d4ab40a37d97817f7ad6b584b8ec
SSDEEP 12288:fi4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:fiiGpxAoYmK9jSjwp
TLSH
T1EC65232372970CE8DA1925B0F8D5A0C6C254BFBAB5500573225FBE9FE873A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 877dc627fd75e21fd7d0370a074a63966eb91f46bddc7b18c0518166af468c7a
MD5 21b04ca33c4029763a7d7d29306ee8d9
SHA1 5c2c0b97f319298a3352aa64c3bf0f7c30f5ab7c
SHA512 39e28f0f0e09fe58392b0a53a09968dcc7f179f18ea713fb68d1ac794a612f976dc1706f411ec836942d41447fb5dc98753bbf45ed3adfbdde72459535e41092
SSDEEP 12288:Je4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:JeiGpxAoYmK9jSjwp
TLSH
T1F465232372970CE8DA1925B0F8D5A0C6C254BF7AB5500573225FBE9FE872B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 da72f9d74030e97c99041649e0603edb0d007796995871a5aac1b7c1c06d8004
MD5 ad580a94f0363542035c5ebac1b02019
SHA1 20311d54357e218bdca3a3c45beb045c5a418764
SHA512 4f0d12acb53090583343cdb9327604425e3edcb93b457b25c37717ba8a74baa5ef337ff3717540d063dc999b3a1913c35b0dd9820892b4fb83acd75f6b364a1a
SSDEEP 12288:+yPz5L8p4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:jzypiGpxAoYmK9jSjwp
TLSH
T17275121373A234F8D5365270D8A21942E371BC3657208ABF13655B7B6E337E1AD3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 f7c92efea53b09c0617516792c6995456a1cee6a5b12c29afac5e1302bb67193
MD5 397addfed4d2b0adbb63c8d69b4f4bf4
SHA1 31f2495e8e1942f36d9b94e8c2e721c01e3c7ed0
SHA512 700f23d1e0ef7f5afa7300aaf8d08e44ed68490b6a325570aa2225b6ea217e9966bd56bb3253fccd43bcc7c355f61c7ef388843cf9dedfc29aa4229c5e441235
SSDEEP 12288:yi4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:yiiGpxAoYmK9jSjwp
TLSH
T13665232372970CE8DA5925B0F8D5A0C6C254BFBAB5500573225FBE9FE833A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 003927a8f62e79fb27911b9c04f0e23accca8abcdc426c3845d3bffa5240d9f9
MD5 7e8accdd5c21bfd51b1f845e08c7303a
SHA1 ffc0b42fe7723b4a917663965cc9f057be968bd9
SHA512 946c842663262701878000c0ff44fc41134e699ce0f81ad8e371396835f297c63728c59e75dfc6f8e0eb5e230ed9b2a112ece2832b88327b43714193b3e24784
SSDEEP 12288:1i4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:1iiGpxAoYmK9jSjwp
TLSH
T12365232372970CE8DA1925B0F8D5A0C6C254BFBAB5500573225FBE9FE873A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f1caf32de1b7e969c0d38297244160f8fda3bc427f84c2e1526baf0baab65285
MD5 661f4bd645bd0760dda795d77c2c3bfd
SHA1 c176eea7d2a2d118d2de5070ae008eacfff8f56d
SHA512 6fcbd84e8c51962ddded73d3dd3536ac870c5c30bb117567985d81728c14cc1bdfc11e360d229494085fb3cff194f906e2d79506f7da82665c00a94b6bb1847b
SSDEEP 12288:hyPz5L8p4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:wzypiGpxAoYmK9jSjwp
TLSH
T10F75121373A234F8D5365270D8A21942E371BC3657208ABF13655B7B6E337E1AD3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 ed8167098b620ce055d369cf984718ee269a4168e64c87d81e8aac220c1f8998
MD5 761fbf04dbeecb9ce850661a51a61987
SHA1 fe44bdd89fd31591bf44aa6766a8b4e2ed6f3aa9
SHA512 4912863857dc65caae1f74d567434af34dcff45fcecb47e37328593544d79c605feb41120bb859edf6ae072b7a056d6a3df0d5e98abb233a2c8ebd5f0ee2ef3d
SSDEEP 12288:LCd99WYoaLHF3z0z04PDvhL4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:mTkaLl3z0zDLiGpxAoYmK9jSjwp
TLSH
T10B750265B3911CF8EC678179CC559846D2B2BC6A0770C62F03A93A6B5F333A11C39F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 562e24676fc999fecd5c1ab68d3af06cba69012c3faf7ad770a425a338838841
MD5 15e0914116dd67ab5b85aa4b4251b2e6
SHA1 e20787b84cfe656c1ee5ad04468d3e4940f5c65c
SHA512 eed900352f205e5509cae8f15bf7c2cb395dc7cd66c58fb0c6d8a249872de1a3c13eb80827bb5443d1870fa09dd2f2a0cb2d783f073fa8902d7b97d061f3e6c7
SSDEEP 12288:Ni4e7vRdTfgwCHKy7GLbbdIvI4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgx:N3od9CHKy7GZviGpxAoYmK9jSjwp
TLSH
T1A795CF90F3E414E8F0B79A35D8765511DAB67C691B30CA8F03A8665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 427eb4d3482a15e824bb950af2504f089eb964834f2b70f9247d53bf76009cef
MD5 15f73c19e58e7d42989c32cf83700793
SHA1 8fef0dc6b494026dac8c795efbbbe7af81db3c86
SHA512 42fc8b1a0683e9d72818578cf0ef5eb8c46acca1afca5614e0489f84c3d60609838b2f0a9bdb491f96874b824bbbb8d447e1a5760226c6c17d7b82b521b4ed95
SSDEEP 12288:pb4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:pbiGpxAoYmK9jSjwp
TLSH
T1B965232372970CE8DA1925B0F8D5A0C6C254BE7AB9500573225FBE9FE873A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 699979d174cc8828a9f550b39e1250249e41659e91f17482b71128df0563d8d7
MD5 81b3fcfbbf70d1178fb480d494c3a172
SHA1 205f1df7b78032017d415690512bacca984d66ff
SHA512 d464307631011125f15c744e9a1282ef82390ce61ec34a41c4a00d4a7ab7684777c47b007ddba64e24696607250863a904cfd3a48245b2afc2956efe46e7801e
SSDEEP 12288:NJ4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:NJiGpxAoYmK9jSjwp
TLSH
T12D65232372970CE8DA1925F0F8D5A0C6C254BF7AB9500573225FBE9FE873A6174A1C8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 6a6bc74cbaefa7997986f5a8d576fe35fcf08cce5334294a1679f0b68d889215
MD5 0086a6fde9c9fad50b8c7f5bd2548eb5
SHA1 4c9fbe83407cfab3fe501f8014afa344e47967fa
SHA512 dd12a782ccb7c0d3b2eaaab18c4b84f1ed65917ec1c50e3841d33086ee42b8def86616c6178fa3f97d4b124cd3e3791e35cdd94f015f2802e0ac51fcea1a1790
SSDEEP 12288:rI4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:rIiGpxAoYmK9jSjwp
TLSH
T1F665232372970CE8DA1925B0F8D5A0C6C254BFBAB5500573225FBE9FE873A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 12d866b794f96c61174a285b449d262a3dea048642f956d80ddbe717fcfe20f7
MD5 aef2679b90d794fa119af9c96792f275
SHA1 0d80d8676d5dd106d5eafe4c4bc86d2411d9d456
SHA512 dab3f75e4ebd2e954aa96d9814f2c466ee16fe5611c675d77449238e3d0d94986a18bc4eeee1ba50f2f2684636e9dbdeb36f08cf94d48d4101dd8a47fa3b4edd
SSDEEP 12288:xi4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:xiiGpxAoYmK9jSjwp
TLSH
T1FD65232372970CE8DA1925B0F8D5A0C6C254BFBAB5500573225FBE9FE873A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 d883cf799216f9ed4f4af8a8963a1758fdbc04db709b4b354d11c38eaf48d819
MD5 6a894ff53e958c396c6606f9f8c4440a
SHA1 baff6f237b170459ddc5a1bc3f1aa669a160fae1
SHA512 ef4fb13f184c50e9bf9913e30667f4c7a7f584c2c09de30698ca344e9f3cb5621e7041a98b2e9a5fca11709deeaea224c73387be760e433df3a2703e881984ff
SSDEEP 12288:zlsfy4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:4yiGpxAoYmK9jSjwp
TLSH
T14E750116E29906E8C06E6270DB969581F3337C6597E0C3DB13D1F97E1F32690ACE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 071d2f8f556e1a7377934752ea53f172a45b3024269275e6df94986f61bb4c43
MD5 986980fbc41c92a4ff047eefca782c82
SHA1 ab4fb2d9b2a6faa58ef0a71400172a18979513c4
SHA512 39977449b720eaaa228ee64129b168c8332003bc7d9fdb8ee4eb3b0c6ed91e0b3c7d523d88729e45d973d809b690c8df0c5db600b4d6ede8c9281012557de0ec
SSDEEP 12288:uu4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:uuiGpxAoYmK9jSjwp
TLSH
T1FA652323639B1C94E97925B0F895E0958218BF79BE504573710BBE9FE431EA1BC7084E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bc21cc77dda31cf14440313156a7e36e3c3c6c406174b0ad2cd02dad566a7cc2
MD5 215566d3ba916559c8d0f196d0ba5d94
SHA1 13c1f4bb6439dcbb36f7456a3e9de2d1f18a98be
SHA512 d6b1a9d472c98271d0d6fd8cde04adc860c7251875bf79c2c159f198e43abeffcf6cab3cb0a8938624180ef31d86d8a15ee9abc256c72172f1bc9c0b848e6ff0
SSDEEP 49152:za0h2GEkuAe73q3pp46zwwQoiGpP5K9mM:za0hNYG4JwT2n
TLSH
T1CF85AF1E67EC82B4D0BAD278C9A6814BE6B2B4261B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 b9ca0b2256c9f3cc2453a90c4331efd247f11a8ca052b4700682489d173c10d4
MD5 e4396c708ee20aee96a82e650c958eda
SHA1 c7fd46ac7e08274af013063f067b525e7886b929
SHA512 9f0d1dcd586d175ae322369c18106d96e407653d89d614847a9b9e355ea73e0b0a8c82580a5b9b2d76ffa8ceb2ce73cfd7c1c75082dfa467b877bfb687b68881
SSDEEP 12288:mhbHjfXP4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:mhbHjPPiGpxAoYmK9jSjwp
TLSH
T1FC65023E22AE14D8E575A1B8E4929446C330BC35271193FF2396927E5F37EE56C31E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c4f2c221253ee2e8174165391c67f2328d2a781fa6d51f8c0a5bc32445da87b3
MD5 3aad55d1e30bd85336e8dec35b5155a6
SHA1 a2995fb52421a335d4bb5e1086665c917dbcd49f
SHA512 dd5f6ff59f8e97440208113963a51a2b9824845ecc327cee45ca7e7388b4c7d8244f214b4587270b6648006b7e9396bdff4f2456e59fcc8cca3323d7c4ff2a01
SSDEEP 24576:o3YgnJcRTk4yti+R5dBR/5iGpxAoYmK9jSjwp:oIgnaTk46pBR/5iGpP5K9mM
TLSH
T1E445BF2EF2B910B8D8AAD136850147B5FB71782D1F209AC70174C638AF16EE85E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 f9e8c1a7ffa0ae234b7e9643651535a4e7e7b40dc4859670eeab15ea3464818b
MD5 c3a875e97b86bc8369784c93453633d0
SHA1 8ad445d0b5f2a9e527dbd832f4bd15b516fb3d61
SHA512 91f00f761dd301926bf8b6140c1704dc863ce5089af1c32239c2ce80af248e7af25f36147cd4d059188e6ed6ac4ef098081cba87157cd428319c4abb86a656f4
SSDEEP 12288:Qi4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:QiiGpxAoYmK9jSjwp
TLSH
T10765232362471CD8DA6925F0F896A0968254BF75B75006F3215FBE9FE432EF274B088D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d30c2d6b1d21a46f091c5aa31a143b74f1b9b69fb7ff1809446f5f15f0a4a7b9
MD5 a24bc88733369dbd6b1cdb79acf127f6
SHA1 45d2dfedb73e1c44cc242ada779b477f4c6462ae
SHA512 830cbbd40083c82a129ce051142d2335716378113fb4adb718ba96e5204075b6c126f130f12d2394992515f21b32738caaa8feab80e945cf71c654f49221d7e6
SSDEEP 12288:XObAA4LWOsvAYFTz4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:44L3UTziGpxAoYmK9jSjwp
TLSH
T1C9850115F39504F8E97B9138C8A29516D271BC6D1760E7EF03A98F6A1E237E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d842352447ad2313ba09aa4d0efc0581647d145b80fb510c2092a07d2a21b253
MD5 2e080574cc15188e997a242fc25a526f
SHA1 fe635fbb49716026af3ef0d67e805edbe1587442
SHA512 48dfc65ff4e85022cd1c6ff69335c57103fe9076fe6d832e6ee1bfe6844229591ef318a34f8616f317e0a8454febed7f53a4533c7dcf34a567d9d224f740ce0d
SSDEEP 12288:fpFtlOn4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:zOniGpxAoYmK9jSjwp
TLSH
T15065012633EE14E4E539A178E892924AC370BC76172147EF029185BE5F73FF86C36A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 08eff8e1e9942e1349b2701e893d8daeacdce44fb8cb3b4eb1b71155a1bd5e71
MD5 ff981bd8a7ebe214a6e433a8795dfd12
SHA1 b0a4afc02b4f1f283475fdb1c168a0900e7cab4a
SHA512 494672a08f3cc89bf2bfbbdbeb05df2e1f6bd9d99618e9ddef053cd1f2dc486a8ce607fca613dd38c69918747bd49cc85bfa90012c874cd16cf8057efbfa5cdf
SSDEEP 24576:T7NM9YqZqmWMUkPjZM48Mv6bEhseiGpxAoYmK9jSjwp:T7cBWMpPjN8DbEhhiGpP5K9mM
TLSH
T18765AE2E6BEC81E5D477D13DC9E28206F2B1B8611B318ADB1152833E6F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9da15f661dcb63337e53dc954096f74fd302858683dd4be94e064f137dc1e360
MD5 aea95868ed0aa3c7564ad0ef2670a1e4
SHA1 ec92b93e4d1af60e71caeeb02aa630d7a0397680
SHA512 5babdf38f2e727fc6342a8020a11db649f19578cbb673afd200d8af83bcf9a4f2ee70897aec25e70548444421bf901c979f38c9dc33004d9a94facb471e2478b
SSDEEP 24576:1W6BApg2YuyuNDYTabvcdvNYf8km1kiGpxAoYmK9jSjwp:1F2YuHNETovAvNYf8km+iGpP5K9mM
TLSH
T1D2857E2A27ED80A4E0BBD27D45B6D146FAB2BC511B3056CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2ff167397c760e9632d6e8fad1c4a2577e083513ffe24d698029f773e43971c4
MD5 c44945b6b8b685632eda581ff93804f8
SHA1 453f1943f054bb647a36e73d8051b32cda87bb13
SHA512 32ce2eae615629bf89c76265bff41fa40136340252499d560da605b3bf5574d0336e0305654f58b0240fd8345d0fed6e02b4172c3e53f9698dbbc3c323af986f
SSDEEP 24576:TAFs06+OmlfQNXEbTo7iGpxAoYmK9jSjwp:cFs060lcXuIiGpP5K9mM
TLSH
T1FF65AE2F62EC00D5D07ED17D8997C91AF2B1786707215ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 0b1fc1642855520d0549ed5581dd87df7aaad1629a08c353fa0b10f8b78acc6a
MD5 c3be2b780416400f1e89945038b5d7ba
SHA1 8e93a1a966efbf5fdaf77d056a1600855a3dd265
SHA512 0faec89340d49d11a267242dee756f3b512348ec4c06dcfdf6927c896ccca64661a68edb7c1180c2129ffe9f3dc0c4585a386a735f57cad7c13290f39114628d
SSDEEP 12288:zCJnJ5D3Vkr8zx+4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:OJnJ5D3WoIiGpxAoYmK9jSjwp
TLSH
T17385D02DD2A910E8D4B7C2B4819A1696FF71383D2F2269C72474D5357F22FE0A979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 706797bbf34715264160677e4dd6a6ff58ecdad4a96ee1b882cbf4a4f5514e65
MD5 e4ac4f22685ed0d1e4c90e14646e7fa1
SHA1 06ba28371547160c3235510332de989b851cdc51
SHA512 5578976e567a469a9077abab1e43f3058a2f6c7ebea37b1b850c1730242886cc3989461e72687bc2eb932fa172d213c9908011fd9cad8581d7b891be82b39671
SSDEEP 24576:hEPghm6/7IIXdwcXrif7qQncjlP65i3Vu5iGpxAoYmK9jSjwp:Gg06DIKdwc+eQnSt65aVqiGpP5K9mM
TLSH
T1D4955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 2c59e0e02830c17c4d6f5c9f0ded4ed7dead3efdbe3907bfd2659696a789f384
MD5 83831d40de856c29bac70bcacd271f63
SHA1 cb2697c3288f8ef61c74dcbf54c33bdfdfdebedb
SHA512 d390bf8ceccb0639e7517636e2b5e6f8a1bd6ee767bf63114cec8c767a28700a69ba03cf18155be254b7e46c987261227e3b0df3963cb0acc39d64d1d080b753
SSDEEP 12288:PEP3RMC4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:UMCiGpxAoYmK9jSjwp
TLSH
T1FA65122E239E24E8D52AA078E4918145C3B1FC746B5127FF1296D67F8E33AF52D38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 11f04daf3053cdc01cd152e8335d6bfec569a8108eb2d422785d6d712399047e
MD5 65ed1a9ac3afb2629e27b09e4b3d6d9b
SHA1 58814632bff7648970fb66cbd057ab9e644202b6
SHA512 b22af137788d818991269226c691942aa879f3d8908b9467ac70f3c95939c469ed0716fb32eae9d20093ea62228a6eab374d3c4ec4b189d39aa979a0e84cf479
SSDEEP 12288:TjkyR4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:TIyRiGpxAoYmK9jSjwp
TLSH
T1F9751211639918D4DA791670E8A390958674FC306F2056EF6195FB3FAE33BE0B830F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 de29005c969fb6b7d21cf75c5a3fe4a3f17f2f9479809d0e278c6d62cbcec367
MD5 845a9d6fb6e6b68c5170e3c50bfd44d6
SHA1 8af85fe16f2e71a3b44b4882519bf5bcf383e00e
SHA512 fea035eb219ad6062bad23a3eb573f7bbbcf727964cb953d81321003f5f37d716500867c13d6c92cca1ae2efebd2c490e8e5bbc9eefe7e6424b8d31acb6d7e92
SSDEEP 12288:5G34fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:E3iGpxAoYmK9jSjwp
TLSH
T15765232222572CE8DE2515B0F8A5A4C68260BE757B1015F7219BFEBFD933AE17071C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4eecc74a8ba084f58549b9a7aed9f57a9bb2ac8b643e00252bfa09173dbcbc4a
MD5 48703df14ca2d31271d37e95dc74afcd
SHA1 efcf41c8c0147e57abd4d63e5ca7a5b758a7b0bc
SHA512 ef64a086f17e12008be1dbdba20b0c703e9c9f80eb970ee794d2f0075a36a6eda4569f16e4da850969edd38edb8eccb16e94a9887bb59cb8adb2e9c51462fde4
SSDEEP 12288:ULQZb3C97GYnZMv5zBcKY9dMD3G4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjp:CQ9MxZKdcz9dw3GiGpxAoYmK9jSjwp
TLSH
T12C558C2DABE9099AE177D275D4A250C3A633B4311B31D6CF2049D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 6c9fdc5e49a39587f603b7bc5178956e10e799f8c84e89f43e9b139d15506694
MD5 6499b0346338f918d8feee74a8aeaa94
SHA1 590edd6526eae2304d24a97b67e7d34ca457295e
SHA512 a8af376c52f6204fa9eaca74b03b34bdf2af178bedaf236513f99726537ae1af496863151c5bdae89d5693d0ed026ae8fc90078c5f0a4e9ce33dfca5c4e7f169
SSDEEP 12288:8yoKo2SRple9pl4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:8yocgApliGpxAoYmK9jSjwp
TLSH
T1FC75F11FB76E04E1E1769138C8858245E773B8306B6257DB6192C73E8E33AE9BD34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4b45ddff0a85aa4d849a3372d6a02c9ba5c3c3bfddbb7fab4587de4c578b244b
MD5 7f350e0cc1e9aa292f321eca3aa460c3
SHA1 08079c5edc258d60c686df4aac22e55bf46c9027
SHA512 cdaa49e98a9820cd01cfb8d579531f065d23a4cae4ef964157d7e3243aa90e2a4232b6a351261a928414b0e6c3a588b338487bf374b39914f354cca3f67ff49e
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKliGpP5K9mM:z0zuNI12n
TLSH
T112A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 75dc111a082b6f06025a9fb599918d005a5e8dddadcc9f7d512d2f8f9482768d
MD5 49562f0e80ea7dfad9eaf0614d8e52de
SHA1 a62ddb5c987742d8fa649b4d37993693543bc862
SHA512 cf7105a787ded625e728d7309573be8ac40e5bd11dbf68ecbe30bc8ba6a4c6651284a1f7ec11b35cbeaf2f0169466132d94d194f6ebcf30c601efd8c5ba03242
SSDEEP 24576:b1QT7EcpfxR+N5AWAz3ooiYsjMqbCiGpxAoYmK9jSjwp:mTDxR+N5YzTujMliGpP5K9mM
TLSH
T1E355B02EA7F915E9D1BE85789A23C502FB727821033193DB42A0C17E1E779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1512-394-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/1512-297-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1512-495-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/1512-303-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1652-414-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-435-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-423-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-424-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-412-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-445-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-446-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-413-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-411-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-410-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-409-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-449-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-447-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-448-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-421-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-444-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-420-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-443-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-419-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-428-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-429-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-430-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-418-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-417-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-431-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-432-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-433-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-416-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-415-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-427-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-434-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-422-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-436-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-426-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-437-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-438-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-441-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-440-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/1652-439-0x000001A730CD0000-0x000001A730CE0000-memory.dmp

Download

memory/2384-396-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2556-265-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2556-491-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2556-271-0x0000000000640000-0x00000000006A6000-memory.dmp

Download

memory/2556-266-0x0000000000640000-0x00000000006A6000-memory.dmp

Download

memory/2860-79-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2860-66-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2860-81-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2860-64-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2860-58-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3160-27-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3160-9-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3160-8-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/3160-28-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/3160-0-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3176-408-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3176-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3612-246-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3612-242-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3808-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3808-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3808-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3808-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4156-275-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/4156-492-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/4160-29-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4160-204-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4160-17-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4160-23-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4160-24-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4172-404-0x000000000B3E0000-0x000000000B3E1000-memory.dmp

Download

memory/4172-406-0x000000000B3E0000-0x000000000B3E8000-memory.dmp

Download

memory/4172-360-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4172-392-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4172-496-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4172-403-0x000000000B3F0000-0x000000000B3F8000-memory.dmp

Download

memory/4172-399-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4172-376-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4312-247-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4312-425-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4360-282-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4360-493-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4480-235-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4480-78-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4480-75-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4480-69-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4724-395-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4740-251-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4740-442-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4740-252-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4740-258-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4756-398-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4888-13-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4888-143-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4932-293-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4932-285-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4932-494-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4932-291-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4968-397-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4984-44-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4984-35-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4984-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4984-232-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5032-400-0x0000000140000000-0x00000001401AE000-memory.dmp

Download