0b93685e329bf0288eae9f87d9178d5d4aa5662e4951f8c75e7ab78ba9630c50

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_5ea71b9ce98afb4b8c7c62e9293f90c0_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 3.0MB
Sample260415-mwp9vacs2j
SHA256 0b93685e329bf0288eae9f87d9178d5d4aa5662e4951f8c75e7ab78ba9630c50
MD5 5ea71b9ce98afb4b8c7c62e9293f90c0
SHA1 cf9b936a88fb8671c5ef0508fe91fbf0f9a43a61
SHA512 6549c36893a34ebb53479110a65535ffbc7ab2daac0d21ca2ac66e4d2397802d3aa20b6ca143aa3a1e4d0e60cbb5753a2f572dbbaadf92cf752c25639395e9c7
SSDEEP 49152:1zVnZWNcDcvAHzQuNoZDnn4dbaLxK7hhak7HFygRGQjF1:1BnZuqcu2N4g+TjUHeH
TLSH
T11BE57B23B1E600E8C05DD1769F4A8332A6D17C658FB1A3DF865173061FB6AD06B3E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4412	alg.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3576	fxssvc.exe
3668	elevation_service.exe
2604	elevation_service.exe
1420	maintenanceservice.exe
6056	OSE.EXE
868	msdtc.exe
2876	PerceptionSimulationService.exe
4508	perfhost.exe
3020	locator.exe
5396	SensorDataService.exe
4848	snmptrap.exe
4068	spectrum.exe
468	ssh-agent.exe
5692	TieringEngineService.exe
4824	AgentService.exe
4264	vds.exe
4372	vssvc.exe
1684	wbengine.exe
3412	WmiApSrv.exe
4368	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\14564efdfd664f35.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_5ea71b9ce98afb4b8c7c62e9293f90c0_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_5ea71b9ce98afb4b8c7c62e9293f90c0_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_5ea71b9ce98afb4b8c7c62e9293f90c0_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_5ea71b9ce98afb4b8c7c62e9293f90c0_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_5ea71b9ce98afb4b8c7c62e9293f90c0_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000311ebbc5ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e36a2bac5ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d22aebac5ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000350bf8bac5ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbba08bbc5ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8b3a3bbc5ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4184	2026-04-15_5ea71b9ce98afb4b8c7c62e9293f90c0_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	3576	fxssvc.exe
Token: SeDebugPrivilege	3484	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3668	elevation_service.exe
Token: SeRestorePrivilege	5692	TieringEngineService.exe
Token: SeManageVolumePrivilege	5692	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4824	AgentService.exe
Token: SeBackupPrivilege	4372	vssvc.exe
Token: SeRestorePrivilege	4372	vssvc.exe
Token: SeAuditPrivilege	4372	vssvc.exe
Token: SeBackupPrivilege	1684	wbengine.exe
Token: SeRestorePrivilege	1684	wbengine.exe
Token: SeSecurityPrivilege	1684	wbengine.exe
Token: 33	4368	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4368	SearchIndexer.exe
Token: SeDebugPrivilege	3668	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2916	4368	SearchIndexer.exe	124
PID 4368 wrote to memory of 1048	4368	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_5ea71b9ce98afb4b8c7c62e9293f90c0_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_5ea71b9ce98afb4b8c7c62e9293f90c0_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4412

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4288

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6056

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:868

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4508

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5396

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4848

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4068

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3696

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2916
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09c0ea7fddb101eed209d9c80f20fd95906521ee191a63c75294e475681717e3
MD5 62794c9532de7c680a24a750062ef019
SHA1 9a085acefdbc5c8cba1e297ccaac0c8a04e5c82d
SHA512 61850d5667acc79938ed3567ec7f2810aff623979c3c8dcd68ad26519ca414fa9062af8812a23b841904ab3bffb037668e74babb112a298b90bfb2e90c4d1175
SSDEEP 49152:Rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnygRGQjF1:X3q6HjBLHeH
TLSH
T14CD58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d72e3acbd074eeee66257cff0b26e9caf1a5d2a8ede3d436ae28ec4ee14ada1a
MD5 842a6e4bea43dc7e9009712c5a34ed26
SHA1 061904e85c285d20e0856657866f40666bf5833c
SHA512 039df8e0689b51955e3f63d4b840d2692b4fcbd827f527a85a148d754c86fdd66db01c2f2c14e76e9f67dc751f83c32f3ad49aab141dae63532ffd5434e63c89
SSDEEP 12288:j1XLsswWkxy2lRq2czAsyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaw:5XYfDtczAsyg6GG1Zees+0FQo
TLSH
T11F65012877D504FADD678278C9A2C501E633BC950B60EB9B03A096291F377D86E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f77dc018129b0980d8de944ce18bb25935327435fc03744ca46b4e09025e9bb0
MD5 a8cd93315ebbe1dfcad2e731195ccfcf
SHA1 f0a81859ef32f10cad24f0c9495601e9cf1b624d
SHA512 7006248546056a9873c38524ee8174a26517db4fd0e62c865a14c635b1d3b4aeca479a959c989bebf688a0c90cf72596e207756941bf6e3c642be9eb4c20e256
SSDEEP 12288:mXZNYVLeyUji0h90ZD0wxpGZIVuFrHs/yg62jG1Zee49+uws3VbJiCl/LAmsYRM5:q0Le5ji0hmxirM/yg6GG1Zees+0FQo
TLSH
T140859E56F6748371D073C0B9C5D2A68AE97130861B308ACB4296D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ff8de650ac6a5cbe263ede4ca83a2f468e1bf44824a2137f793a89a55eda49dc
MD5 2edb0eb585da31a665b3ecca436f07d1
SHA1 4c30691f0a3a83e640a2a36c99d42ad5b6894047
SHA512 5c6359a544cc4280b0ff1a9f3728ac5edac39dcffbb4e71d1473ff3531aff1315c69f01841f9ea054c692f48c4ccd5ef36a4b1bb21b59fdb1b4f5891d3fa2dcc
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyudyg6GG1Zees+0FQo:+/ezSC6vUzPvxHjy6ygRGQjF1
TLSH
T16A755C65F5788323D0B2D0BAC5D6AA99FE3230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4d3b49d5329c29b1dfce98d72ee3a14fed2e1a895a9faf0174a0658105cccceb
MD5 c07166faf11763ba2236f39ef294da5f
SHA1 0288cf1bd57e2cdb78c1d015e6cce97c6f9ba2a4
SHA512 46527df78caaaef2eabcbc86a76cd159704de11ae9c77bc40ed213a952015fd67e31452f17d0ac17a6cd2f682cadad4891314f3e3001166fb6ff15e5e2757155
SSDEEP 12288:LVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98Ayg62jG1Zee49+uws3VbJiCl/LJ:LVbqPb88hv/l+6Ayg6GG1Zees+0FQo
TLSH
T13A55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 07ce4fdc5d72521a7b4421d01c56ac78a9df0b1e34b15bae863550f8dac21707
MD5 ccfd6d9a20388f96d7ac1aba2516951e
SHA1 42724e9645dbc3e60c74c76d1502592ea0a1dc2e
SHA512 877a111a70ad023e0c6c734aeea820c2560058f3294ecf342168de29a03acf6bfc60424cc2ffdf7bd852e489507a797f705c2b95e1479c85d65441b55674cf03
SSDEEP 12288:tRzyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaV:tRzyg6GG1Zees+0FQo
TLSH
T1554523D69A4651E3C7AA8271F7DCE2005022ED9C2C408F6B2B71F75D1A7EA91F90CE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e69aa9dfd1bc8ee7415a70bf5999816083c3e8bbdc7c52fa1de8a6e3e3965a72
MD5 f978e8355121416d313cc9223a144137
SHA1 5c12ddea0946dbeb4e770c40742b055cdc3ad1b5
SHA512 80f13c1344530f2867e7feb61a0dcb5206b55f4cdd80683ae15cf869e68aa76e2b5a1c6f3ac07f7c7f2c2f5b5834e15609e36d5c4b088c60597777db09777f7e
SSDEEP 12288:ceBNUbTVO86UYyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaU:cJIUYyg6GG1Zees+0FQo
TLSH
T19F65CF7BEE28FCE2C27A89B95B91C200977278704F5193CBD275830E9E275E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 47067bca43578e3e9f87d4901fc88f2107c0f07fa936760d800bb93307953a4d
MD5 6aa9f30f1b717d14cd2888f3a242fdf3
SHA1 7aa2e3d8ea4ae395232c2490fce4360822d0e4a6
SHA512 74c1ef1071f090096568ecbf6836f4b99ba6bf74b2787cf3ed8ae42e175458c1f55a48303a860c451d25792f970c100ba57e94375ae45dd71d091a086516773c
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:CQvGAdlCEL8c/yRNw5CsHeH
TLSH
T1D4267C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 af262e0d69e3e3edbda62fe55bebf32a77382362d1296b0cb5759afaf4ea5c0f
MD5 792d8e46937cd3d298aac5993ef0ce6c
SHA1 0069ea18b23749d29cc5dac6c086b6c7df0a4648
SHA512 28cfdf96b1b2afb5df1e62c1050ce3b2786f369063c04fa07b644160312bfbd7d275ce2f130f029be8daa7d29bdcbb8e5e647ba80d99c7229f08bfa90820b8a7
SSDEEP 12288:5AwSfxL/2Dc34DLLmt0LDQewsAjuyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWV:qdewsAjuyg6GG1Zees+0FQo
TLSH
T19A75E071FE75E032C3BF0DB26B25C716142DB9600F511AC3E3A89A9D59342D2673AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f63d2ac67d70b8f80fe1d3b98022f6f773cb0413a4449bb6a96b311ef5b86ec1
MD5 9716d5efde91ecacd80c54b6ffc706e7
SHA1 e2fbafc3227a59027f5694d3383d9384bc96134d
SHA512 f700270e5d9a87d4a3475d55fb0eafcbfece3dfb6d3d4a9ad8fa18c9e37934f7b7d78432195f569ba821975c67ecfa1fd9c818df2e35046f71ea6b256fb332dc
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH5e:UUEtQevvqc2W1cpV2EI32
TLSH
T1F8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e4a0445cd1cffef81507b8caaf5df26b94fc1520c33415a02b6b01d60753570c
MD5 7da317c8bae7b61ef57dce66e2eee89b
SHA1 61daaa3128111323b7192eba1c5db0527e14d8e6
SHA512 acf9bb83fb1478343c77810beb05c24c9024496df738c64e16f794568042384f8a8407d13fd9d25baf835d54650f7291a65e69c5510942832144f353607b878d
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zOygRGQjF1:roqtVjnmgHeH
TLSH
T157D58D0976B8C2E4D1F6C37896A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9d4c863545b77129417fc5355b9fa625f4332f0d434fc0ad5450e8ab91a85427
MD5 2456315e5fe4ba25bfb8d62621cb7680
SHA1 23523513b1dfe85d609f835a7fa7bc60fc225707
SHA512 be914045865610470bd34b26422c5cace3e7b34b4054ec98e9fd0ab2add9ef5258a69b86038d882849439a1e25561f0f0aa1e2c23dd09bc10b27c9f781482087
SSDEEP 24576:XAhGLJIFoiwtA5l7S535yg6GG1Zees+0FQo:XAMyFoiq5JygRGQjF1
TLSH
T147359E81E7F951D4F5B3A67899B69170EA76BCA95E31C20F2260D21F0E37E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 3405d0a3b22e2d4909d21b5b65c9d4c496a00086d01b3d14b2d80f21992c1003
MD5 7e4bdd56c0a62e607206b773ef1c478e
SHA1 e0e8221d6c1ff1ac0c755321f99528e80b7ae18a
SHA512 9b8bad45978b820d2c0648f85c1766f323878e8e925997e6944d30f0075a98ef32f564f2f0c76c26ac514c9a53d9ed325e7bd69ef5258905d52839cf283ede88
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+C9yg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaL:wwuoOWayg6GG1Zees+0FQo
TLSH
T19365F186769508FAEAA78139C697C131E7B2BC052A21CB1F1760C75B5F37361BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d18cd93801cb1dd127e796cfdb2388c3f0fee5afc04196325c6d9d9e95101a04
MD5 77ee8938af4c25dcd211606dfbc39904
SHA1 e5a96e08996d7fd9b140fab7113102fd2e88be3f
SHA512 5e4ebc4b8901f2349687d9774848e575feefc6ececbd47a7f973d3e6f37d4c3bebc2e0dc7c4e76b45f83a196663ae87f4ffe68b83a45fcf053ac59db3bb0a006
SSDEEP 12288:eBZ1Iyeyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaz:YZuXyg6GG1Zees+0FQo
TLSH
T18E55129A27D421F6D3A78279DAE59601D332B85A2B3147CF172093691F37AC1AD3CB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9bc122c5fba16c15c5c63a036ab7f961208d7615e730d1768fd18c9be22097a7
MD5 926051d8289d5a3e393bc8312a5e0fee
SHA1 648416f05cff840511ad057c3a289cdc4054fcfd
SHA512 6301c03f5559f9d7e93df568757d4963897529a76a4ab6dfb73ae3b93e015018668e657bcd72af201961dd4d97f5d161b061d70b6ddbcc019bede89c5db474d5
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:MQRQyi36YOcPQLvw2gAf+PN3nHeH
TLSH
T121667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8e0ec17b3f21c9bcc4b706954071ada0cd91d51ca419181314d18ad6c66b3d50
MD5 13bbd403ae7e5c077fcbe162bb6366f9
SHA1 8b4ddc7ae87edbeced55943ad54741739956694f
SHA512 ea5f7b94dc350083e345cb6c2aef98193fab2ac1aad7092e0275926eaac0d9f2416ca6656fefcf84c31ec702e24869ff06fe3c44b056935a4d33e6920ce5a81a
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:GQRQyi36YOcPQLvw2gAf+PN3nHeH
TLSH
T10A667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f90a8e84109ac21809edc949e37186b2e533aad1dec67c40c0ad7d5de231ec32
MD5 951ed9190b23d43e47f404b1b0d55684
SHA1 49b0cfd1a3a51a9f6d72162f5df7d607d079587d
SHA512 df88784f2f25505baa14b861ee535cf40458888e5e9117b99a571ae360d39d6949e52d06e4ab80618e5d54c5acd486634be5f832b61bb29faed0e31110972f65
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0nyg6GG1Zees+0F1:568Qg55nhheWu7PNU3/+ygRGQjF1
TLSH
T1F5B54A33B2F600A9C44DE1769F4A872196D27C758FE0E7DB851173061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c98cd3231b6c2199a0b8773f71cc36a4fd9936bffcd3749564df1edbaf06479d
MD5 a8df62769d5bccd90f4b4d9325369013
SHA1 e509cc6b15d4d7c601ed563dbb7d3fb871c3825e
SHA512 24ca690bf4562a698a18c7552e8dc2093982dda16a336984369e6c00aa655bbd04903fc49afa72a05118ecfe407e725a03c47a54696e48bf96da6dc5308aa04f
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:0y5112gYy5azzVvL69nLKnhZWHeH
TLSH
T1F4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 686c547490ffaed1730f4c38e7ed9af157c7f1ec2ae7f1637c099c4258b3115d
MD5 ecc8e255a4cb9cb53295a67714d61d99
SHA1 ee8b7057668aa788203898a0f11eb6543aaece1d
SHA512 5e9b005b53ce5166f6e2da2d4cc57f0bbdcbe3b0d312d759fd468e107f7926f7023c069ac8d8412fd572e3e83837e02fd85c922ba25ee729d06e65473b4c44c4
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8ygRGQjF1:Wu6JmVxd2dPHeH
TLSH
T1E9D59D13F1DA01E8D06ED178974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 96c61dd2325824cf528a1d6d84e0839d67796a2ac05298f05a25eb4ff9228791
MD5 3f84ea6fcb62d53b070eb58cb2c656ea
SHA1 1e9ac405fecf61583b7ed0f1467eda3c1675272d
SHA512 446fefee239fbfacc234edefe6c37fe940f10416b22bd276eb554151bf67802d4bea5a89bac6b62aa4e766057e3132c9e0cf4259c110b917a4a34242f024d054
SSDEEP 49152:K1hpsNoJpF1A6UU44CwH7R4x4ygRGQjF1:KmifPbRgHeH
TLSH
T1CEB5AE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 40c43a88ce1bba3af24f0bc5b6fc57e5bea079268c885ef1a57aaa62785eebb4
MD5 2fc2a7e1a8e0e2a2602fe38f8b806533
SHA1 50af1441b74343368517a3659c6639e606303b29
SHA512 07e1ccd180f54950e39c09595586060d24a7e58518a78491a82610fa4a64567a5fc696e24e78fdf8a61ac8d688dfd03461bd1ef0bdcdf6d94ebcca6cb03b466c
SSDEEP 49152:3SuZQIY0Be2KRRVtOnks6NMHqXygRGQjF1:t5dKTi61CHeH
TLSH
T116C5BE03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d95a487db05e1bc3dbec7428f67c84af8a38f9e8eb68af052691adfecba92570
MD5 984b2e1d6f4f100a1e47e90301c3a775
SHA1 c1048543289e3bfc3836d9f8fb36e180e159b067
SHA512 82c186f996bffc636d6f4e3868f66fff930a98fe5866b6dd4224138bc8495f6ef814344323d7ed3e01fe7e7440f751a9f19a2000df54ec38b627a7b8bead576f
SSDEEP 49152:UhtSn8EApI0figngiDn0AP5wsygRGQjF1:1X2iyphkHeH
TLSH
T11095BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8e95c4859f1a2c296baa0af1e38ae02b4a60901da577760526dcdbe6c96f1571
MD5 d554a3fbc612c4b45af9a83b60c8782c
SHA1 013b6fe5ee8174170471eabd9dec149b15dc28e6
SHA512 44c8dc9021be0c5ef7b2a651af69d38d900186e7b804710abac21eb62d5175e7754f87eb0edd38e04f93e9ddf657ac94b56366d28e1401ce64f61ee068d857b4
SSDEEP 12288:7ryg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaR:7ryg6GG1Zees+0FQo
TLSH
T1C24523D6AD8752E3C35AC2B1E788E2005022AD9E3D014F6B3B61B3191B7EB95F50CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c67093b5dd05ddd7da6ea5ded8be089e487d88a3fc6f5bcfb9225a4a16d339ba
MD5 b17f8a220967fa70e3cbcffd7c6e74a5
SHA1 5187b13cabe902a1d60fdcbe36fd9d5a71168a50
SHA512 2182f983aeda7b5d66f6bbc0373d5b84709cba0b3a4aed8389b34a3bc363b46ce58144311e51130bacc8a2aa068fd55514ddeaf15c71a538e5aec9de6eb40bea
SSDEEP 12288:ACyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaR:ACyg6GG1Zees+0FQo
TLSH
T1F64523D6AD4752E3C35AC2B1E788E2005422ED9E3D014F6B3B61F3191A7EA95F90CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4692fc6992196330309aeadaa7d60be436843a15d6c469e718b339d4f648e0e8
MD5 be277f4be08aac437a12d06b20e9f673
SHA1 a581ff6b293cd98a4176e9948fc0ebb5f076f017
SHA512 cd5457f9cbeb3e38d33e5b7982ecbb4ab7726b5c72a459114c90a1241862ea34cab7633000ce267c9d9ce5676372bc5c78c4012968f8d4ab57493b21053bfc1e
SSDEEP 12288:hQyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUab:hQyg6GG1Zees+0FQo
TLSH
T1CC4523D6AD4752E3C39AC2B1E789E2005422ED9E3D004F6B7B61F3191A7EA94F50CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4c0436732c211c1515a2ea7a506b87c48c816608da987f1bc38126724efcf5ee
MD5 be64e4452fb9e6175d4e9927e9f67a90
SHA1 66c788b98d0fb26c70383609c05fc47743c8e904
SHA512 212704ff620044877f7f2b38c8b2ad9d1189519c7b9753f79de6b26372f088deb5d3bd003987c8d745a1dd7794c760c6ef4c2eda21a10967e9cd3ad2aaca5fe7
SSDEEP 12288:TVZyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaj:Pyg6GG1Zees+0FQo
TLSH
T13B4523D66A8A41D3C7A6C275D799D200A132FC9D2E114F9F6B10671D0E7AB90F91CF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 381f31a66b461e8eb295bd3361fd7e0b97ade907f8080334fa398c9597b9d58f
MD5 d3ea302d721b85932b958842ebdbf205
SHA1 ed816b7b8b9c8b513d03cc8343fe5f99261098b8
SHA512 3aed7f43bd86f6cb362aed54291ddf6e3c2482b02f8ed89be065a973cd0c4330f8e6347169a2e86c2250afece224df3a8858a3c127631fc82f000f99427aa660
SSDEEP 12288:qhyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUag:qhyg6GG1Zees+0FQo
TLSH
T1FD4523D6AD4752E3C35AC2B1E789E2005422AD9E3D004F6B3B61B3191A7EB94F90CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 706da745188ced77147b706c3bb96c8ef049dbe497270ccad49f070fdfba576e
MD5 797575358dd7f1a6b816f04a3ebc69bc
SHA1 4e916d4c7e09d8f031fbc610f07dcc1d26926ff4
SHA512 5cec498e143ca9970abcd5760e245e1c12b9816af71139eb32c31522941f0ca566b5425a8c5863c2d65faaba5560e147f13e19bd12821ba6a69b881b5e6e8bd0
SSDEEP 12288:Wmyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUag:Wmyg6GG1Zees+0FQo
TLSH
T1F34523D6AD8652E3C35AC2B1E788E2005422ED9E3D014F6B3B61F3191A7EB95F50CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a8da22be18b0ee635e09c641c2b9c40a44efc8346cb176934c340a3c60fc3177
MD5 228cb8c01db9a06eafb9e1d8e852a6f9
SHA1 7de701522319d4ec6f00e9dec057e8c6310dec82
SHA512 7aeed1833d31ad0944f4f107332b3ba70ebbf288d5844307b1972fb678737736d5739f11a814ff5d60d93778792571cefde2ac894f2b6036976e74315c39b5df
SSDEEP 12288:Bqyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUa4:Bqyg6GG1Zees+0FQo
TLSH
T1374523D6AD4752E3C35AC2B1E788E2005422AD9E3D004F6B7B61F3191B7EA55F50CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 003d848a633c2eeb569b8d72086c600128cd10b8b277b5375a656d6c1f1943ab
MD5 72a99a89e86fe32cff8844b5716d8454
SHA1 f59d6ac31675fda9663c22b13d5e65a16d9adade
SHA512 2081e6d58b3bf73e41264eda64b8d8bfab6971e4af3e7aa77c83a47183cfb9d302a135e4d5b782810c97e5b1982b06260503cadebfa33b05fde4355c4ae9b39f
SSDEEP 12288:NiZwb6zzFEoS2cPvyiyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaP:QZMSzFVSOiyg6GG1Zees+0FQo
TLSH
T1856501A5B39018F5DD67823EC9558902D2B2BC5A1B60CB1F13B4372A1F373A16C2DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e3bed1396785911c36fd91ef1b5251d95054c16e70b90942689b6a5417594b23
MD5 674d2a78cf81f68d50490016449856cd
SHA1 49c751a141d1e54b2e9505fff62bbf653ceb8bd8
SHA512 136ce6299dcd05ac53616d94300d07186799dfeb55b3c3ad5d137d8df594d70634a8833f3b1efc9400341b325f4b835735a5434b87f36314877fbc7cc9a1be80
SSDEEP 12288:sHyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUad:sHyg6GG1Zees+0FQo
TLSH
T1AF4523D6AD4752E3C35AC2B1E788E2005422ED9E3D004F6B7B61B3191B7EA95F50CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5fa0f575d77f47a61a5ca091a627dfbe97f85a7443289ede455f1d2ac2c4506e
MD5 a42507c93b2d67ae5211a17d1b42dd32
SHA1 1f46ad7e1282b80e5ee60757f88bc8a762fe64db
SHA512 43349e72846cd07a0820fbe3fe5247314fe4d82f7e8a04f99f8a42921110e653f09940db06947798ddf2bb93efb36779052112f6cf9b5e493a1db3fc1abcffb6
SSDEEP 12288:djyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUam:djyg6GG1Zees+0FQo
TLSH
T18A4523D6AD4652E3C35AC2B1E788E2005422EE9E3D014FAB3B61F3191B7EA55F50CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0d88f1278771797d6c53090815b1a6a695f7d11d952f4b3c38bf589d93ad75f8
MD5 b9469f88a41e2538e6601e6a236caf40
SHA1 ede0e20efbaab4e860c834299adb9a46f5d364ab
SHA512 dcb52ea092036128b8f4dfae99f82c0f952a714e1e27af57731eef08f70f689a754d647d399b834bf5d915465adb99cc2abebff190ba53d4bd2f3d19fea62c35
SSDEEP 12288:PyPz5L8eyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUac:izyeyg6GG1Zees+0FQo
TLSH
T120550257779230FAD2668235C9955A01F332B8761B208FAF1760537A2F3B690AD2DF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7d0ccd6e39ec11482a76ad8f28428d38ee0ca2ed90311311220de7e92c38f5ac
MD5 6c9cdbf7518b1bc3b32df1d2ba038f8c
SHA1 b5badf6ed3d05c2b520fcf6c5efefa18dbfa8beb
SHA512 7a4b669603e628019986bb740d0f4f5a809a63398ed4fbcc6f7bee2dfa8fab440c9323f10d3bf923a9b6513c23825b305e1970f40f3c09a1bfdd4507e9f304e8
SSDEEP 12288:WHyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUam:WHyg6GG1Zees+0FQo
TLSH
T11A4523D6AD4752E3C35AC2B1E788E2005422ED9E3D004F9B7B61B3191B7EA95F50CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c12ce1af48361717a8e5e3d7f8476088086e936483426263ad7864feb81fba18
MD5 5e560481999637ddf10d4a667ac4ce40
SHA1 c65828925810bdbeed675dbb0a966573c101a0f0
SHA512 5019db71833d623523ddefafaf0e8fad71bde7af46b87695f06de3923e893c8948086a5deec777f2e6ee2900db061c4d7ff566e342b512a961751b511f14cb14
SSDEEP 12288:WHyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUap:WHyg6GG1Zees+0FQo
TLSH
T1574523D6AD4752E3C35AC2B1E788E2005422ED9E3D004FAB7B61B3191B7EA95F50CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cefc36c2672596c85eeb10430a81f30209f048178b1fe6e0598302cf776661ed
MD5 9d01e5aec05202b4891d2b4de2cf9de2
SHA1 0a25ccbb9fd256f7e860377fe5480795f864cdd5
SHA512 7b1b6e1f47ef7e6f6b9797e85b713c9f13f7e313455a46e4f469d12ca13c450c7ca64b1f2719c5a4800d643cc7152c34530e6a7e7b6106bb7c8aedb86ed493ef
SSDEEP 12288:AyPz5L8eyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaP:xzyeyg6GG1Zees+0FQo
TLSH
T197550257779230FAD2668235C9955A01F332B8761B208FAF1760537A2F3B690AD2DF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e30065b6307913ccdf20723fc31f9f86ed5ee221bf064c79860359a933014a59
MD5 efb8e6ee337e7fed26ef50c35a198448
SHA1 819ea5e98563d8ec4a984c65d9a6901818067200
SHA512 9ac4004544dac54d6f773cf93af6cfde126dce14a8c874254aef4fe4513ec1b73320929d60647c09fc34d1f5de4bbd230d9cedcfd909c9f767df6012c39b8bbd
SSDEEP 12288:LCd9eWYoaLHF3z0z04PDvhgyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaT:mTHaLl3z0zDgyg6GG1Zees+0FQo
TLSH
T1A06501A5B39018F5DD67823EC9558902D2B2BC5A0B60CB1F13B4376A1F373A16C2DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e901708243fb0ae9371a48cc123d964e46a1a8b9e169706cad92f3c6bcf68862
MD5 98d926a8849cae4379220eae09e509ef
SHA1 b09e853e36495b3c15e62d0d72f6f56f000ae826
SHA512 658624db844dd3936f0143e4c3e150004da631e900eb372e065464421145ff263b7320269e2f97fbdaf6a2417d82bcada38e6d2b14cfcf2b8ad21bfd548140ef
SSDEEP 12288:gi4e7+RdTfgwCHKy7GLbbdIvlyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUao:g37d9CHKy7GZEyg6GG1Zees+0FQo
TLSH
T1DA75CE90F3E410E9F1B78635C9769511DA76BC9A1B21CE8F03A4661A1F33BD19D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4306bf2653169e7fb56eb8ec2c2130c4df33b318859a3b278f86737fb2ace5ea
MD5 c6eb6a7041b7265f02eadce998096086
SHA1 d93534beeecab8e87443faf12172ef9d48569e55
SHA512 16ce305e622c365913b29a820c8123be5229029b14d9e0f9cc6a1eae909c12b8496c55cc1ff5d2faa07c35814e273041730e4ec9a9350c76a6d6459aeb45f229
SSDEEP 12288:ywyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaT:ywyg6GG1Zees+0FQo
TLSH
T18F4523D6AD4B52E3C35AC2B1E788E2005422AD9E3D004F6B7B61B3191B7EA95F50CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ad61281d9b5fee5da4c00af6deeb2dfb5138e1b2d15f355f0b1a51286f278a2e
MD5 1baff3a0132804a964ade0151923b454
SHA1 fc95cb0cbee43fbb7bf9576a9eeaa9c0613e5e53
SHA512 a641339c5f69831f9e159d3e8be5edf23f14ac191763cf7652d0bbe8677e14ddf119fd2a222f5fbbecabfa3393647560ba5ba2d2e4e401560e69fe7544075203
SSDEEP 12288:m+yg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUa7:m+yg6GG1Zees+0FQo
TLSH
T1024523D6AD4652E3C35AC2B1F789D2005422ED9E3D004F6B3B61B3191B7EA95F90CE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 8a1b47a0275338454f51d1d9edcfbbc93cc1d83b660bff5e2eeb58e6ac3394ae
MD5 ea74d19308a70cb4b45e4aa7f4b56b59
SHA1 a3b3a70e0b5c73cfd82017ed530ef24a56d75dab
SHA512 91419584b100dce120ae1891ac162e8c462ccad2a345f1bacbd32114148f2e0e426a9aa3ea89c56b3a4e69f83c06135263a56ea87d2b78e11df6576dc4a302d9
SSDEEP 12288:CNsfXyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaA:bXyg6GG1Zees+0FQo
TLSH
T10C55015AD28802E5C16E9275C7858600B3337C695BE1C7CB27D0F63E1F7A690ADE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6b96ee3dc183965ffa315d547dc5a5e21ae24bb13f43b3288f7bff14f641593d
MD5 d0d7e40f42b1fca1f6d2acdc2054eb74
SHA1 422cd82d116bceb1c106e380c9e75772371f80f1
SHA512 920380a34b5f78c17285d83a48cdd398542240b314e2670ce7c567021784cd9b2f24295e68d98a82427bff8f52e035d2a63af23bebf20ff824f632c9d21e104e
SSDEEP 12288:Wayg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaQ:Wayg6GG1Zees+0FQo
TLSH
T1BE4523D69A895193D3BAD270E799D1102027FDAC2E008F9B7B11B31D1A7DE91FD0CE25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0d85ce86260a720a264493f9c440eb8b7cadb918857be939ee67503186559fc9
MD5 1e48e325b82c13c73be21d7f3c030aa5
SHA1 087881678646c47fbf1823eef53c5089f024108e
SHA512 93895477b821b8cdf3a603757075ced920d2d74407c1b991e54679a41b772493e88728ce6b52db7aa1817e3a536754e842096cdae9cce83e704913c8555d9385
SSDEEP 49152:ha0h2GEkuAe73q3pp46zwwQMygRGQjF1:ha0hNYG4JwmHeH
TLSH
T19885AF1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE48E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 6919a4c74af1293cff8baae975ec3d348ce4b1aa00ad1492ea629c507aaa4ff1
MD5 c8bedbb1f6d43faa8368053ce4fe0c9b
SHA1 037cf80fde0c2c43cbf608d4ca8ba8f6883e5c9b
SHA512 e24d021f3f9fb6da464b5800981bcfe41fffe306182c15a0c2de0aba2fc655716d0340e9004639754545626ed014865d1b6384d98a8c2d85b8391c9e877d439d
SSDEEP 12288:XhbHjfXhyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUau:XhbHjPhyg6GG1Zees+0FQo
TLSH
T18A5501BE169D20D6E272D279D6858206D331B8691B1197EF2391837D0F3BEE4AC38F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 806094fd9aae446e717d0893cb55c1b394da0801d004ac4f6f90e191cf96eff1
MD5 6ef5a7cf9c629bd4308852b22480d62a
SHA1 8389d30c871f8ec3bafbe9275d42d6025a56bc57
SHA512 27c6c5e6726ab172293ebadfd69f6673b2437e5cdf91d30b37aed6c703d7c8494abffaa14fd7cc30ecc99731e5ea6c4f9e8a4b67b6824fa8dae2bc87185e9f55
SSDEEP 24576:w3YgnJcRTk4yti+R5dBR/Zyg6GG1Zees+0FQo:wIgnaTk46pBR/ZygRGQjF1
TLSH
T1A945B02DF2B910B9D4A6D136850147B5FB71782D1F209BCB0170C638AF1AEE89E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 86fb99a366305d4f89919e331b811a313ac16feb1015faf4ba1684a87693b857
MD5 165c5b068d2d4617620b2da9663859c9
SHA1 47061e9e362bad995b075fdbf5c4d03a8f3c3569
SHA512 bcfb413ec67287adc8ecb9fcf357564809d98c74a04e59895280a463f42f771c39b73031bbf03d5e603e912f569fdca88756f1c39f08f4a13c59fa1308de550e
SSDEEP 12288:uOyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaq:uOyg6GG1Zees+0FQo
TLSH
T1FB4523D55A4651E3C3AAC2B1E789D2006012BE9D2F014FDB3B61F3191B7EAD5F92CE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 789b962153c6c5eb2cb8ccd573c3139edbb2e11bdd9f1e92237d2beec5805c96
MD5 36ea904e35db348d110a66f2e8252780
SHA1 310a6791708934b3673a58a382bcbf4c4191d7c4
SHA512 796238077d11fe79be685d7fb1082706742840efd66bf1f801787f35a3e18d52406f3c8922cac381d29bf662f1bfbb7109699c6212e42d3894652aae49b4a390
SSDEEP 12288:KOb9A4LWOsvAYFThyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaQ:7pL3UThyg6GG1Zees+0FQo
TLSH
T19675F155F79500F5D96BC13CC9A68612E272B85D0760EBDF03A88B691F237E19E3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 a203196013617057e15b2dbe08c6f2173bba44615f0003c2b71d103f08fe911c
MD5 376a6864a8150da6555d9947c96886bb
SHA1 d048ec3db2bb60a9aeb7065516b63fa8498f098a
SHA512 0fdf3849ceac4768d3620810346abe358033596efebea9f4bafdab1b746d8bc80eb2adeac2df99fb42bd98fdc27d6ef8f835ec548ee48abe59a32c27786417f8
SSDEEP 12288:5pFtpOFyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUarf:5OFyg6GG1Zees+0FQo
TLSH
T1D755025A36DD10E2D276913DDA868309D332B8691B1147EF0790827E1F67FE8AC39F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 14975ed5b5e110b7875814394091600b7ba313dfc29fb3ec09a55ebdcea3eb55
MD5 bf9f8ec4d5f430702ab45824d4801b47
SHA1 7451d688a57b49e8ddb3ad57c54c9b17fee5e0c4
SHA512 6615757500f1167599c6e586cef223b2e6afa58ef81345986688e81c26588a9f130328cebd2bc254212c010e4287b843189c1161db55826b3fc6810bb6ae0dcb
SSDEEP 24576:G7NM9YqZqmWMUkPjZM48Mv6bEhsqyg6GG1Zees+0FQo:G7cBWMpPjN8DbEhXygRGQjF1
TLSH
T12B65AE2E6BAC81E5D577D13DC9D28205F2B2B4611B318ACF1162833E6F37AE45E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d507a4de5c588a710c5bb6ca7ea837bf7e63c1186085b4c6753a2078ac5f7b26
MD5 1c464ed311d95c6c12ddfd8443973041
SHA1 f6b6e152726bd9486fb695ce2e8ca76f5eaa2554
SHA512 bd4f6d2a7dfdce00f334e339c622f920dc617de85302917b13849c96374481466bfc9de5ce9e621af1a3ec5205fd3af696e93c1befdff7b5a19f18a403ff0066
SSDEEP 24576:KW6BApg2YuyuNDYTabvcdvNYf8km1Iyg6GG1Zees+0FQo:KF2YuHNETovAvNYf8kmKygRGQjF1
TLSH
T1B4858E6927ED80A4E0BBD27D85B6D246F9B2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a306ddafcf2d325693137a0e300103de5ed616f8f61ccb8e3ba1e11e47379689
MD5 3e996252946aad0db5957d25a0e9e040
SHA1 d1195d994e133e75ee7709efa034ff7ad38edc1c
SHA512 df63a39aca8d3a3523b3f166e674973842653dc445e5b573ee2d0e9340bd66ced9563f1c1230ae25833143b5f878bdf72ef49235f3731246467da6c0ea75bde5
SSDEEP 24576:PAFs06+Omlf3NXEbToJyg6GG1Zees+0FQo:YFs060lVXusygRGQjF1
TLSH
T12865AF2F66AC00D5D07ED17D8A97C91AF2B1746707215ACB0260C63E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 1d694e564a1d38a6f3d5ce7a7fe9a69d40f55c820591ad9b0aba58fe7dc6e21a
MD5 1dd49b641a62e15b57bf1e27a96e57ec
SHA1 a8b77fcfdd2911e50e972941eddba46b7cd22819
SHA512 11ab3d2079af925d505b7c4c99f37bd2f5d854e91c924dd5978bc954485b727bf8e4ddadc51b29caed12f3fbf0591c57fdb8897ecc1303389b6e21517fe00dee
SSDEEP 12288:zCJnJ5D3VkrDzxKyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUa0:OJnJ5D3WXsyg6GG1Zees+0FQo
TLSH
T14675D02DD2A810E5D4B7C274829A1745FE72387D2F226ACB28B4D5353F12FE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 56d37c741867f5ab752eae067f82ac9b798c9cb642cc71591fbf2a5063d91773
MD5 b0920a80a1f438457f995ccbf1635886
SHA1 831224490227a987a4b4e42f3c893baf3d61ed7c
SHA512 05a3c07446bdd880a00d8ea933f4245460612bba72ad01008a0ec0b70b373b931131d668970299c6308bb46746f696b6c85614efdcc14a65da480e5d34665f87
SSDEEP 24576:4EPghm6/7IIXdwcXrif7qQncjlP65i3VuPyg6GG1Zees+0FQo:3g06DIKdwc+eQnSt65aV2ygRGQjF1
TLSH
T1AE956C15B7EA5294E9B3CAB1CA62A1159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 62366255b06168bcb384abb4551cabaff60cb8a9e70cb2d55c16f50f6fda5bd4
MD5 6c28973f9e592e950863d840bd3f1451
SHA1 59f62b600321d5d09d60f82df4c4127c2d826c95
SHA512 13dcf0376594846e8e9c26b839787c76491fc3f395237086b9547abbe9348588dd7e4def4e50a6e57ab8ea80cf3d53d047b1d314b53eed62d58db3428fc112fb
SSDEEP 12288:iEP3RnWyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUa9:hnWyg6GG1Zees+0FQo
TLSH
T1515502AD2B9D60E6D26A9179D6918205D332F4742F021BEF16A1D33D0F3BAE56D3CE10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 37475577111c8a995660c74a2ec20eb1f924fd58ddba76366727737c8c31b047
MD5 0f2deeeea4b4241d7cb49f5f2efde1b7
SHA1 ab30bf31497fc0f79d01361038bf6dbda95a9884
SHA512 89733ff51c200729ba58d67e60b07fcc110aaad37e43e9e5eb407f21435b2d1bc2cf745ea237d3b9140c4cfafbe1d2cc334a5b8084c472997c94554d424a6df9
SSDEEP 12288:/jkynyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUa1:/Iynyg6GG1Zees+0FQo
TLSH
T101551285678851D2D7B64278DAA682509931BC642F114BDF6690F73E2F3BBD0BC38F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 1b4ecc70685adfee33366f51a0854dead5c05f9d4b742d74fe1fd64497d692ab
MD5 b684760aa4bda2fd3ad86b7a3ee31a1d
SHA1 aed6204856776ec12418435b4d283a9e74912a38
SHA512 fd6476b1e6bf5fa8ac9e5ca5672f9bae6ca3e63784916cb47abd1b00e343359d94c543b1a053ec1679bded090124b26c422dbe0f2257ffd550b36e81780ace9e
SSDEEP 12288:/y1yg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaQ:K1yg6GG1Zees+0FQo
TLSH
T18B4523D95A4661E3C75682B1E79996005022BD6D2F004FEF2BA0F3394F7EAD1F52CE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 61f5edac8c7a250cd75ed664e7daf08914acfc3e0be55bc5f03ef5ae1dd9d945
MD5 6bd112d15c735ccd5525d598fbae67a7
SHA1 3c49621d01d9608254d7a936ef925ce54d7f7eaf
SHA512 72738f389b4d610d39fe960fb9f7f0a00a5b3b97eb9fc9e4ed4569b0ff702b40c684211c84b8c04d7baca2bc5289f74be89c11baa10b1b07101a7cd4782fd46b
SSDEEP 12288:KLQZb3C97GYnZMv5zBcKY9dMD3yyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUi:8Q9MxZKdcz9dw3yyg6GG1Zees+0FQo
TLSH
T1C3557C2DABE9059AE177D275D5A250C3A633B4301B31C6CF2448D13D4D7BEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 713d9fda7e75e1cbc36cb13264c05db6648b34163f7b295995a23b7e9fb0e964
MD5 1c3edfbaabb7e5a944a3ffcf92edd61b
SHA1 124abb865c7a1cbd79b9c4b73db3eb786cbafab6
SHA512 0e1533a171ccf25c888276bbf7328e7c45e21a2dfc6c98395678b21af8c8140fd698792905df49d58956afc7b9ce821f483a12d9bbf9d701fa2c3096b096ed96
SSDEEP 12288:oyoKo2JRple9pLyg62jG1Zee49+uws3VbJiCl/LAmsYRMAIcWUaT:oyocDApLyg6GG1Zees+0FQo
TLSH
T1F165EF5FBB6A40E2E166813CC9858205E773B0742F6257CB6691C33D4F27AE9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fbc1a9b700cf653b1b72ab4ecf079198d5bfd8cce0215bced3bdbbd0abbbedb9
MD5 c4410b1a8a4b001df5fd6135d50db265
SHA1 0f0f224821106ec99fd93c019b5ff5564605600f
SHA512 65bb5f028bc77bdf168b332eb98939febe5708beab8aac025f7291c59de6db7e79738db5cb7c7e8bfe33d969c04488382cdaa014b2bfcc502a585dd290149369
SSDEEP 49152:KWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKLygRGQjF1:M0zuNI4HeH
TLSH
T17AA57B3DA2EC00A9D9AAC375C5451366EA71742E3F2059DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f420d5ea53f053a8aeebb346253d8519f82dfb971526be54fdb039b21239f172
MD5 aa618b85e98b697e3ec3d239b4cd934d
SHA1 68cc1c6140664f6f7f17a9e6e00387c50dc50ff4
SHA512 16ef2c566e46e42d0425a5392795f3bbf873ba5ca223d8e85d023ee0239d3c1efb495ef92a7c8b7d78a39aaa868ff5fbc4a3e1712ecd73d4e6b4df8429393aa1
SSDEEP 24576:W1QT7EcpfxR+N5AWAz3ooiYtjMqbWyg6GG1Zees+0FQo:7TDxR+N5YzTfjMDygRGQjF1
TLSH
T10A55B02EA7F815E5D1BEC5799B23C502FA727821073193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-430-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/468-320-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/468-323-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/468-314-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/868-332-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/868-264-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1048-432-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-445-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-433-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-469-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-468-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-459-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-460-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-464-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-465-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-466-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-463-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-434-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-461-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-462-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-458-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-457-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-456-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-455-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-454-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-453-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-452-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-451-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-441-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-435-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-447-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-446-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-444-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-443-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-437-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-442-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-436-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-440-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-439-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1048-438-0x0000018A59040000-0x0000018A59050000-memory.dmp

Download

memory/1420-69-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/1420-76-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1420-73-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/1420-75-0x0000000000C00000-0x0000000000D2A000-memory.dmp

Download

memory/1420-63-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/1684-343-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1684-506-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2604-239-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2604-241-0x0000000001370000-0x000000000149A000-memory.dmp

Download

memory/2604-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2604-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2604-58-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2876-268-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2876-336-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2876-275-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2876-269-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3020-292-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3020-346-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3412-348-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3412-507-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3484-17-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3484-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3484-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3484-237-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3576-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3576-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3576-49-0x00000000006D0000-0x00000000007FA000-memory.dmp

Download

memory/3668-240-0x00000000006E0000-0x000000000080A000-memory.dmp

Download

memory/3668-39-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3668-46-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3668-238-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3668-45-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4068-302-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4068-309-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4068-427-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4068-303-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4184-9-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4184-34-0x0000000140000000-0x0000000140328000-memory.dmp

Download

memory/4184-0-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4184-32-0x0000000000750000-0x000000000087A000-memory.dmp

Download

memory/4184-8-0x0000000140000000-0x0000000140328000-memory.dmp

Download

memory/4264-467-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4264-333-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4368-428-0x000000000CAC0000-0x000000000CAC8000-memory.dmp

Download

memory/4368-422-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4368-390-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4368-508-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4368-357-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4368-406-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4372-337-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4372-504-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4412-235-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4412-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4508-342-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4508-283-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/4508-448-0x0000000000E00000-0x0000000000E7A000-memory.dmp

Download

memory/4508-449-0x0000000000DF0000-0x0000000000DF7000-memory.dmp

Download

memory/4508-282-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4508-288-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/4824-330-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4824-328-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4848-424-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4848-299-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5396-296-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5396-356-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5396-450-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5692-325-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5692-431-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/6056-84-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/6056-242-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6056-78-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/6056-86-0x0000000140000000-0x000000014020E000-memory.dmp

Download