b34e389627fa300cce65d5fcd12728af85a86c9a6728372abd653405f938278b

Analysis

max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/05/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_a27d03d040ff642af099f4464085c682_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 3.1MB
Sample260505-sdaz4aet9q
SHA256 b34e389627fa300cce65d5fcd12728af85a86c9a6728372abd653405f938278b
MD5 a27d03d040ff642af099f4464085c682
SHA1 e65e2db8913a875f7dd33517686676e9c8a1981b
SHA512 0de000c97a068ddd78e053fde089bef225168e9805e4d57717918c1d8f39b4f6881b7ccdc6ecaa2eb975f705988d4cbd16be861f5d549a39a7332bb0a91c005c
SSDEEP 49152:zFc+NSD84i95TtZ47gZ5CGm8VvuSuU3OY7wGh5ELHB+kn3Hnx:zFceL9dFGoXVIh+k
TLSH
T193E5AF13F2E901E8D06ED2788B6A8632EA72BC454F35B6DF065072151EF6EE45B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4100	alg.exe
3256	elevation_service.exe
5004	elevation_service.exe
3652	maintenanceservice.exe
4004	OSE.EXE
3580	DiagnosticsHub.StandardCollector.Service.exe
3448	fxssvc.exe
4356	msdtc.exe
548	PerceptionSimulationService.exe
4572	perfhost.exe
5112	locator.exe
2868	SensorDataService.exe
2524	snmptrap.exe
344	spectrum.exe
472	ssh-agent.exe
2712	TieringEngineService.exe
4456	AgentService.exe
3044	vds.exe
2520	vssvc.exe
2292	wbengine.exe
1040	WmiApSrv.exe
764	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\78f835f8c8368bef.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-05_a27d03d040ff642af099f4464085c682_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eaa28911a0dcdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9edf411a0dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c23a0312a0dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a8f9511a0dcdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9179f11a0dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b73ea611a0dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e7c8211a0dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2432	2026-05-05_a27d03d040ff642af099f4464085c682_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	4100	alg.exe
Token: SeDebugPrivilege	4100	alg.exe
Token: SeDebugPrivilege	4100	alg.exe
Token: SeTakeOwnershipPrivilege	3256	elevation_service.exe
Token: SeAuditPrivilege	3448	fxssvc.exe
Token: SeRestorePrivilege	2712	TieringEngineService.exe
Token: SeManageVolumePrivilege	2712	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4456	AgentService.exe
Token: SeBackupPrivilege	2520	vssvc.exe
Token: SeRestorePrivilege	2520	vssvc.exe
Token: SeAuditPrivilege	2520	vssvc.exe
Token: SeBackupPrivilege	2292	wbengine.exe
Token: SeRestorePrivilege	2292	wbengine.exe
Token: SeSecurityPrivilege	2292	wbengine.exe
Token: 33	764	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	764	SearchIndexer.exe
Token: SeDebugPrivilege	3256	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1556	2432	2026-05-05_a27d03d040ff642af099f4464085c682_cobalt-strike_icedid_njrat_ryuk_satacom.exe	84
PID 764 wrote to memory of 3592	764	SearchIndexer.exe	119
PID 764 wrote to memory of 4760	764	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-05_a27d03d040ff642af099f4464085c682_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_a27d03d040ff642af099f4464085c682_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=147.0.7727.138 --initial-client-data=0x224,0x228,0x22c,0x1d4,0x230,0x14027f7a4,0x14027f7b0,0x14027f7c0
  2⤵
  PID:1556

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5004

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3652

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4808

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4356

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5112

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2868

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:344

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3316

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3044

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1040

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3592
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b562012c3daa19d2eeb17d2ea4aa1fe62b33d2458769037c9ebe069e1db59b0a
MD5 a0add4305557c557e30758a3aadfe0a8
SHA1 c0cdc3b0277c03bd6c2f641076e2fe15ac5e6d4e
SHA512 6a6fafeb532fa890675a4544e5449432617cdf6639ffb4195e5ecdb4590d2bf7a966f134a33d8cb7ba7592e0fa7d75abd7364cbf691e08ec5c998e07b13c82c2
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxn1B+kn3Hnx:M3q6sjBE+k
TLSH
T184D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ad8c84bb2bd6e484fe2d89ca4b48065d362b05c09c4237336fc1b8dcb08f7cfe
MD5 ef9c4e04b0350757b421e9bc693b919b
SHA1 7958493afc1178fe37680825356fe1d1423211a0
SHA512 d86ea20dd019bdd9a0912687bf93e2dc0ee04f892efafc7e582225cce4ccd285c344c19036f2552c80cbdc4ff795ccb1756c34226bd6f21cf8b776fd0e56108b
SSDEEP 12288:v1XLsswWkxy2lRq2czAULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:NXYfDtczALNyBo4kx929bL3Hnx
TLSH
T16F65012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 81e43a504e5f9324693564f4733dc5a9f98e84d04ec2a4b63e06497a37c4a235
MD5 a717b251344b875cde585afd3e500607
SHA1 5ec588f50c5b9f227bcd6905be8d3fa7214b3d37
SHA512 9bec48307f228068a1a255d712cb9c3f6005d860cf0f417b0989e6c6ce0f27e9293fbb2c2af08ccd4dda1cfb9d6b983dea908e6968260c4d9dda28d7871bf062
SSDEEP 12288:wXZNYVLeyUji0h90ZD0wxpGZIVuArHs5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:Q0Le5ji0hmxfrMmNyBo4kx929bL3Hnx
TLSH
T150859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4e3f794faf65c7319bc7bd17d60d55fbb60dc6438c655dc4c937647df878794d
MD5 6bc781cc8a956d6833c8bd7179c2281d
SHA1 d5a7e287ba73fcee26fbeee6cb2e2f7485cd98ed
SHA512 83273d524086382aa606841e031c550f2d8609f545196f8c2e251e7d2faf88a17944749aacbb0a267eae78ecc882a98812c0750b8fd4c7bb83c87ceaf01abb6e
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWn6q8wyuINyBo4kx929bL3Hnx:Y/ezSC6vUzPveHjyqB+kn3Hnx
TLSH
T1BC755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 55a8f9ae6ec2bd0f2d7ab3a5622ac99ca0848ae74760500eeebe2c2ef1cfc68d
MD5 ff0abf16ad0ba14aaa022ca2da1dde6b
SHA1 b02a8225e61eae982326269c9c7db4af2c0ec989
SHA512 ed6e360b595287b814a742c257598f724835470fce8fe703fbaf3017abf5421a04118db3b77b334592e9bec4dd09a72aa4abb7ea5028ce29def32e384e4337c5
SSDEEP 12288:HVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im984LDAptNyvUgXZ32dT4ePc7N29CD:HVbqPb88hv/l+YnNyBo4kx929bL3Hnx
TLSH
T1E6559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2c177a4ba5ab9dab551bc18c7d81f84c924677e8d9355dc1b25132d1871d8569
MD5 4ffe1db590058ff8bd3a1d7dd308bfb5
SHA1 6470db9e626cbfc41093bbb9ec1ce144195d986b
SHA512 01d7a27f95e984af5ad2fee79d40ef49b536cf0458d94db10df1e2898831f837eba6bcd2a407e3257f45bc9487ad1871c4a2d3fe2c8802de7f1a820a5dca1b9e
SSDEEP 12288:VmdLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VmCNyBo4kx929bL3Hnx
TLSH
T1D34523124B0C627AFBBD3F70749E8454CC35BC8D0D95DB94DE62ACBB58BC9A2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f5e15501f26f45de2e988a2f40dbdba8ad82014a09468dae62143cafc9731796
MD5 11a9e4d50d887d8f4165cec6184d2053
SHA1 21f324f69cacb432517e0c6dc1823030c326ee86
SHA512 c5374cfa2633bc0de44a2be66c618bf2a926d80eef3daab75ae1f09f17c0f4a7bfbd1ebad701b5e394dc8101966fa81489985b98a9844a706880cda70e4dfb05
SSDEEP 12288:CeBNUbTVO86UwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CJIUPNyBo4kx929bL3Hnx
TLSH
T1B665CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dfa604db95fdcf5817849c94b0de805cecdd1dd56d31ae014c18d6dfa17f2936
MD5 67d1ce33e1778b624941d72ee32d4a52
SHA1 4430d118df5adf34e21f36e33cdda82fa9757235
SHA512 1b9bd0dbfefabd27eaae5c1dd8149620634130fcbf95812e9759b5c9de7d44bd104dcc564d3ce053e090515906839290a555877d63192a1daa5aac7c8aede997
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH6:gQvGAdlCEL8c/DRNw5Ct+k
TLSH
T1C8266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a631b5232df593b0badeba6e4405c19067d494b2f8ea75ff8a13d87e6032cebf
MD5 a447d4474f704191846e841970440830
SHA1 0e4dbca29a2255e4660e6adabc0ddb84b6454b05
SHA512 4cdd7e6c0fe2ba60b0c1edffbc107e78e35f7b0c124398641c3020ce2535b25c8b02773592ec7692d3439caecf06e43c06b3428df5c97565f6e520b1c0cc41be
SSDEEP 12288:yAwSfxL/2Dc3XDLLmt0LDQewsAjyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:3OewsAjZNyBo4kx929bL3Hnx
TLSH
T19275E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f79cc73d03888d1b019eab225e8125f7f95a4238372b4fa0150b9d2fe7e8ccc7
MD5 55064fef89d7a5d7ed17d509b65f5488
SHA1 8ff71e66b9fa483a313e01847867ccc43fe2ffa1
SHA512 182e4112d6815055412bada1881d58c2e7507073f922ed7b9a03001f42b6a697cb151cf66ebd18b1bcf41fdbd6dc746b15615940cf91281952161b7adc4e8be3
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHW+k:kUEtQevvqc2W1cpV2tI32W
TLSH
T1C9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4fa9a9914e8a2b350e03e6a486563a634acc44dc05b565a2de31ac01345797e4
MD5 b2a6d62efa2943f7fc7716ba5d0b8cec
SHA1 8e5e31766c9d6edcbc231340375dff4ade83b373
SHA512 f09c8e970f66b9a404ae4ce1c6bf8caa512adf46a144b38b250bcb116c753112d2ffc7d11e754fd1924d6f5180ce64c2c8252273aa282c9239ba0c067540b2cc
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/z+B+kn3Hnx:+oquVjnmx+k
TLSH
T1BFD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1c13b82491551daa6a58d698f12bd8a33fcf756c536d51cf25bfb0ad0e35e45a
MD5 7fe15592be93af4938fbe4c2215d0b2b
SHA1 d8d9e575c5b418f58e052a0a0e7b83ef1ea6d127
SHA512 d6ac4236c422c35361460c5941412964b224bb97067c26d41fd576110bde64f835eb1172773d57364537ccb44a734caf35632a103892aec0e9a728b4144c3bc3
SSDEEP 24576:lAhGL3IFoiwtA5l7S53MNyBo4kx929bL3Hnx:lAMUFoiq5nB+kn3Hnx
TLSH
T187359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ef2b43a8fbf6041d23f1abef2dfec48766ee160ae4bbf461ede1588f425bd456
MD5 241bc564656ed35ffe17c984332d1059
SHA1 0312aeda08c3b5e8dbe2c1a4105f1c15e84749f2
SHA512 2d09aa00eab6a29e1bff797efd7f789ecc7ebbda99b02073be4f968060d786311be083d32f65c5312187ec07d71512c57c858a7e5dcb2f1b8e76d34949ee1f7b
SSDEEP 12288:fmw5HEjsChNzBFgl0WDm+CrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:ewu6OWtNyBo4kx929bL3Hnx
TLSH
T1D365F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 44ab770183df2a64a334e976e075d54e69584a9d36980281c6b53a26f53dbb40
MD5 4189e1591a52896a99f0eede1762523a
SHA1 67370556949c8f2485c7d6804e9670eb5b4139dd
SHA512 609c327cd00896215f065736f3b093582ce86374facc5f6b8a5aee581b1736b5d307c72ec4c31f15571851e05451acb7fed2627bbfc554901f2b9e7ac0202a3e
SSDEEP 12288:hgZ1IyiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6ZuONyBo4kx929bL3Hnx
TLSH
T15B551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bb209d21fcd34d2d194ae659ecaaf707166561866c82db75c83af411ec2bc4d8
MD5 0835e2a51b13f218e553b05bdae7f354
SHA1 78aaa63bbb1764745f6c8b5fea2d94cb14ea44ab
SHA512 e6dc164aa8f61188cdce03ff305ceef0c3744da778cb2662aaa3163b24f762c1e9d5cb76954c841e21522f501b66f5cbd602361be31dc9bf7c7166664141a4c8
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uu:xQRQyi36YOcPbLvw2gAf+PN3g+k
TLSH
T1F2666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 33a4239964cb40b0d86d636f46a1fc0c9671f1037cfd22ef4525d3f9fc4b9890
MD5 1e2b7b2a1ea74a2f9de32cd10b4b36df
SHA1 66c782c53de7efef4e90b839175506fd58dee993
SHA512 33a6b4350384b1c2b51b5f08b4ea818cd25d95acbdfce7e9f671caee2ba17f5b46e8a730692426a9645d18185af217c8add58d8759263a61e2ff4f456986ca4d
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uu:wQRQyi36YOcPbLvw2gAf+PN3g+k
TLSH
T1C1666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dde3459ea587b6d904817f1f2300eab3eca0a89b71971af90b8e4eb646662a28
MD5 0b3bf0e26d0b61a9b65d8d95645e5a38
SHA1 2716c75dd78781d1c50e4e60c52f737dc39d51df
SHA512 6705dff46745d55e831c406e14b78da68d0bc12bdde27b76e5da7a0bd56244b13a8dd5c336a66c4c26a005650948779b9f3642fb6a45fb6ef546d5e67fa0a63e
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0+NyBo4kx929bL3R:W68Qg55nhceWu7PNU3/uB+kn3Hnx
TLSH
T13AB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2632ba4dc6d8312d16e8d56a43d496542f95d2b6bf45bda3ee5e281234a00b1a
MD5 790f4c02123ce835e1f1cd4375775868
SHA1 af4bae6fd89062cb898007ce45a85b769e33cf3e
SHA512 36005a5f57d88b906e685e1483ef27c6daac4d3da5c7fc2d4cd483e5752d2f266cacf2ea0d377868a0b36300ace7938059436e991dee43abbbcae74abfdd0f9a
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99g:my5112gYy5azzVvt69nLKnhZn+k
TLSH
T164167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 eddb454625ac7a0d53d62ee7caa91267fd118da8b0994bbe69324be0ad13228b
MD5 65ef18537f22bf002db05cac9ca661cd
SHA1 8a36dea59342634cac39bb4149d205355423eaa1
SHA512 a234e26910603e390eec42998710eef67dabfd847b7cf4701b109de944d7cc03bafd24175cff28428c23852d941bdaa956664e231f25af688bf0bfc7981ccd1c
SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glUB+kn3Hnx:su6Jmdxd2do+k
TLSH
T14AD59D13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d81448410cd640985de809802126dd1e910366f2340f79154188e2ef9e251371
MD5 3fb57ae091a995735cc7068edc0e6bf4
SHA1 8c4a8c7f800a9548bc0aa0aba1494740f630c49b
SHA512 51e516c581121e07942d2fe0b0588a536284e88629a9a08814b099f71080cedcd36a6d32b95800b4a986c05bc14dd7caf54d517b57129f9c81f5932a610186eb
SSDEEP 49152:U1hpsNoJpF1A63U44CwH7R4xgB+kn3Hnx:UmifPWRx+k
TLSH
T10DB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d3755c9697a0bc36948e5638178e58349c2dca66a8066d11246e9e9fc78a8ea0
MD5 919c77bdb4691f9c80369e9e3433ec74
SHA1 e2a53d57650fe5071677d3f4cec87ed387a06b86
SHA512 4b7a0f1ec6f45f9823d0b2fd4c83fc2f7b0580d5d0f3879d4a5dcceff8475feba107a1207862a743dcd731aadb2818688b455135de7d20aa124795aafa183088
SSDEEP 49152:hSuZQIY0Be2KcRVtOnks6NMHqlB+kn3Hnx:v5dKii61z+k
TLSH
T12CC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a9de503ce6d493f8ecdac2d0556aac9be3555672a07054bc011a2a7175fb0e5a
MD5 5f2e2a3ad02805da1c90074626cbb68b
SHA1 0760ce4097173ccc784d17eec4d7dd22e3f8ed59
SHA512 2e31c1cfd0f0f5770b47867bc99a6c263e8060b17003fcde163ac8986fbe857bfcc33e1565fa171e30cb44c15677eb25133d5341d0330b2da59cd881e0bca898
SSDEEP 49152:DhtSn8EApI0fig3giDn0AP5wEB+kn3Hnx:iX2imphl+k
TLSH
T12C95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 803376c1e732696dc227b10d9d95691ccb04a5539dcf40959af06ba2aa7dcbf0
MD5 458f6d9b29f43ff612fcf4d3644d4b21
SHA1 ef29d4e85bdca282c59975d6522076653cb133fa
SHA512 6f28e47bc246af21f7e0916816b68b5cdec82c1f9b17db336e676926cb91a993ee1d02940ac785f20c6edd4e4e6e99bf870ce08626ebee2abe5187b64ac7b2ad
SSDEEP 12288:2VLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2KNyBo4kx929bL3Hnx
TLSH
T1284523125A0C627AF76D3FB0644A8498CC34BC8F1E9593D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f24fcd162b9d1821283e52c8f05f4b2fe047c2be67cad12cb472c1897590af8f
MD5 7162f558994b0aea256afec2f1f61128
SHA1 5e026ceb68036d3aabf8579f6ea263b8b32a28e9
SHA512 11ff54100f234d631c8dcb1aced829ff00cd47c54275eabdf4cc52f10c8f012222d48b204c4ab6d80ad2ab4939656d93a1a855c2a71127436ab8e8e7b692d531
SSDEEP 12288:kGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kFNyBo4kx929bL3Hnx
TLSH
T1334523125A0C227AF76D3FB0654A8498CC34BC8F1E9593D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4b99526b05d9b3eea2864dbe7655ad09b6ec4f121dbfaf6db7729bdc2a9d2dab
MD5 7394babf7f4db2a946ab93b9b4dc55cb
SHA1 e6c4e52f9257a16c12662e36000e35d6f449b9ba
SHA512 9a8bd99c51c7616cf62cbc1211c865bba7ec68e280e2872097cb16d3018f80fd1b8d8adddde9db791edd2bd92f1d08a9761248c795646b6eb9075c72ab86ad2d
SSDEEP 12288:uILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:uXNyBo4kx929bL3Hnx
TLSH
T1364523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 bfb951d754d438bf899e4083616f5855f6ce62eb1d10deb50cb088e3d1616c1d
MD5 cd9adf114da5acec61d73e8e8d11991d
SHA1 8db0cf3dd41628f3d1ec394b80c5d8a36d984875
SHA512 b02e0d6ef566daba23f42d15f17cff7866a6eac772572c453f0f5f1bef7ee49400a6782b47377582d4eb8bc57197157b9159a99d86b41a18f0c40108dd136fb8
SSDEEP 12288:QVXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vNyBo4kx929bL3Hnx
TLSH
T14C4523125B5C12BAFA7A7BB0D8568054C835BC8A5B7197DFDF124CBB0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 45747aee72bb74f55e211099e826c92b9b6a429e490edd8520443b8eba381468
MD5 ec2d169690f52452ba67fd52c6a9d125
SHA1 ac6dbcf23eff3bf47404226c0aee455b2b9d00a6
SHA512 df7f89502541202df04bc83835839e6805f0d77e5abb00cae208ca799d714e5e796ca703bd68485f5b645c8096464d9191c8ea8551fe29552dcd3b3989c57a71
SSDEEP 12288:mfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mkNyBo4kx929bL3Hnx
TLSH
T16C4523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 be91f440ea1d29f223034fc75209db4d8c38645f136542398c5a206a5afec47b
MD5 bbc0fbe1798507fb2993ac2370c93470
SHA1 073bba2218487905b05bd25c2208e019ad3552ce
SHA512 c3823b476c1f85fdb2730a8a8ee5a7339e1a965ea9a0111cb57814a243855b3a2fe222bcbd4eeee0ca1079e1468c3fcd559844b1907caf6c4031f2e1574b39d0
SSDEEP 12288:wKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wBNyBo4kx929bL3Hnx
TLSH
T1BD4523125A0C627AF76D3FB0654A8098CC34BC8F1E9593D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cecaed832337d2c7654af92ac74e59e8c801c578f9b424a94a6433ffae54639a
MD5 a789dd0512c4e1c4d37f991be6ee8248
SHA1 cb3a09bfbe0eb83923b5c8186c90b60eb39d6ad2
SHA512 c8c4a839cdca4b97172768fa848f4aaebefc4f6d04b9d2d2e6d2246d5149d77772ba0e41eaa24acc82be3d85ffcf03d734afaa9c9a92d7892716fdd103a9a3c8
SSDEEP 12288:/uLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/dNyBo4kx929bL3Hnx
TLSH
T1FC4523129A0C633AF76D3FB065498498CC34BC8F1E9593D8EF27987759FCEA25A20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ef1f4aed832aa6ca0df164053d4c66eada22ed405223d9dc9e0d0d4b51e49c00
MD5 9170eb89f4899a9564887eb7c048be44
SHA1 dd1d72baf1deb841d5f2e7003324ef2e04ec7364
SHA512 bc2c2534963d9f458af653fcdfee704a9f3c2b893631daa9b4d65a11a6413de4f2bbaa692d42f569da58f0b1c814f94098c924101aca966ff9cb5972397fb94a
SSDEEP 12288:NiZwbjzzFEoS2cPvymLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:QZMXzFVSOlNyBo4kx929bL3Hnx
TLSH
T125650195B39418F8EC67823DC8158906C6B2BC4A0BB0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f400b72a07ad8e6d20b6535585811c9294c2210831a0d7089610da942b2b8dbc
MD5 96c6ad673728b79f780480b52e4db197
SHA1 dec178651bf9c6cdd6450e431f0ff42bcb243f21
SHA512 cb5278f7c222962bfaa85a413011711f81b07efa91e282a517978f45584b536664879837435ffb7aebcd596967534683697c06c407f365d5302b131803329afe
SSDEEP 12288:+hLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+eNyBo4kx929bL3Hnx
TLSH
T1D14523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3654410a4544a77f199a434ac801468a16c9c43edd6515cd91948a56858ad800
MD5 134f984f41612f20a16b33c7976765dc
SHA1 e1ca4480d5f77c424749e0e166c32fce5855816d
SHA512 7708b4da2bb83d1a9af726ff1eb9c268c0ef765878bf9e436d1025de3142277a9e1589ef191f857f8fcc12ac8d0084719be43b1c2e5d723a04564ac0ea3531d5
SSDEEP 12288:BNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:BSNyBo4kx929bL3Hnx
TLSH
T1D34523125A0C627AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a51a98129e4a8dd00ed15c24cc550868b9135033f52d7bfb7eef8b6546d83364
MD5 8d7fc6333c7d3ee2c175f2a0bcde7515
SHA1 7a09bace7bd8e3b978da245d38c0d378fe47236f
SHA512 08471cf475f46c99338eaf6cb4d35aee92191805cf408d74cc3e1109f81f02154deee0dc39fde763f64d4f1986d82c936b18ab1ea3c462bc03f781bc04c38ecd
SSDEEP 12288:RyPz5L8iLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AzypNyBo4kx929bL3Hnx
TLSH
T18F55120777A431F9E17A6234C8960A01E771BC360B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 23cb1abd3967a15b3663139668ce706ade342e318d24bb50157181fa4d154abe
MD5 1880ed20c901831334810b361822923d
SHA1 4f65bbe3e7aa886873ffe30bb7597db9e649b4af
SHA512 341714267153e39f2a37304618e5023db95952db483296d2eb1b189d4f7c0bbc1b823f6a280291827d33f08c6c5b6db53d376d14c9964a9933b6539c68803c68
SSDEEP 12288:RhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ReNyBo4kx929bL3Hnx
TLSH
T1384523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 694ba411151d2357072785687688878ce63f596bc07619399af4046359c2d63b
MD5 f808c1c902d86b11a658982a3c7548dd
SHA1 9d99a5253650cdd48ce4486c93e3122d6fccfd9f
SHA512 7a9d873c194291cf8de7a9de153548821b188e47e795e62bcb00213429180c02a89827c195e8358269c43b3c41ad8f534b691d66f78446a5ba475f77c3875983
SSDEEP 12288:fhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:feNyBo4kx929bL3Hnx
TLSH
T1244523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5c6e912ab0104de63a6e69b57495f0f3a9e73831e332d79928d115ea7528a073
MD5 81b6ca74deefe3dea768b5177fe3f444
SHA1 3740f09386c513ff7a67e112d89a4733bdcaec96
SHA512 419eb7f63527f318ff9e9a1d21c9622f245569781099f036e8c79909d77070fa15009519c078df6d0a0cbc246f911c35f5a02d1e5b206af12c89a0551310384f
SSDEEP 12288:vyPz5L8iLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CzypNyBo4kx929bL3Hnx
TLSH
T18455120777A831F9E17A6234C8960A01E771BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7f151da231e80cbe860e3bbc05403510d48fe00d9cf8dd1caff1ca76fe8712f4
MD5 7705016c71603a2d9373a8f7c1a657d9
SHA1 112bc431b9fe8c54b60837c1aa2854f83a764a43
SHA512 a3dadf2938582edf5f1f73ad439fbc1d62be669f560de18ec34e9c1b83a1953904e36a164b44618ca0b6a799ce38696826ed282b526023e75fa0765f1a474eaa
SSDEEP 12288:HCd98WYoaLHF3z0z04PDvhYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:iTtaLl3z0zDHNyBo4kx929bL3Hnx
TLSH
T17F6501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 09f1af3929672ccdcc2d512840e52fe6499c988ce174f79d8ca4636adb7faf93
MD5 c4bd1af201bbc093c31d255791392f07
SHA1 080fd9173bb5665a854c7f15c35a7498468dc160
SHA512 334cc5ae4e7e775a7bbf8ee627bf6d429815b75f2495c550062437651ae1cc9a4203097e0b18ab73fc30025ccf4b9d24d5ac636611bfb9d8b71471e0f38f7345
SSDEEP 12288:li4e7ARdTfgwCHKy7GLbbdIvTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:l3ld9CHKy7GZzNyBo4kx929bL3Hnx
TLSH
T1C675CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2c209b5ae54bfef2b0b4306fff302d12eaffb71b2b6d2162628c801013e41c6b
MD5 a5cc19fcc34e89428dcba7f61780672b
SHA1 8249244fdd9d36048529714daead5f490db71d9a
SHA512 44dd3d11b12c6076500b8b30806d64b80bd14729518cb29f4f826a9717c466c2f15b238afa597749b6f0be1d84e3d2046db4a46737a61ebee1c459aa8555fe55
SSDEEP 12288:qoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:q3NyBo4kx929bL3Hnx
TLSH
T14C4523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9cff4d576bc62033bc7f2fa39d932876e132a0b993e171b6c4ebda7014a6732b
MD5 9cc67d010a26af9004a61e5c2846f1f1
SHA1 39cef57a1dd0e91f00fa6e35e4415b5a6b46a771
SHA512 b891cdae1752bc03c2f6fc9e8fd3da0e7566631101cad8666011dda05109861f67861d6faefd8f7b9e47cd956649ba251353793746482b46ae93a6b765054426
SSDEEP 12288:sCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:sJNyBo4kx929bL3Hnx
TLSH
T1CD4523125A1C227AF66D3FB0648A8554CC34BC8F1EA593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b4f4cce2b02ed4ede80eb4776c7d4dbc0c7a7bc2a96e7810deecd4e1f67de43a
MD5 754d9641c0830de7983780a7db43e758
SHA1 ead2331fc5d4f494ef991a1b56ee7076d0a30467
SHA512 d41d2765747d60a8fd711f00aebfb119aed2ca4117e326d380f410518c216da45c44b0a838d0e73934ba730200db39bb61541e9b1c937680c792b259c5efce1a
SSDEEP 12288:eTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:eANyBo4kx929bL3Hnx
TLSH
T14E4523125A0C223AF76D3FB0654A8598CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7a016728f35632716f4f3eb6c8a0faf930892ebb061fa41caa507105ad3c2040
MD5 65b1331cc864f6ac78c07305995d7bee
SHA1 3364d17e478c895fca19d7a7319639a40a536202
SHA512 38421012c670a7553dbfad534997b63e2e52ccaee6fb0d4698113a6bc07677e75ba9f695fe4bf947ea3275d4ea943e90b08b1f59d9429159f71b22958409e147
SSDEEP 12288:4hLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4eNyBo4kx929bL3Hnx
TLSH
T1EE4523125A0C223AF76D3FB0654A8598CC34BC8F1E9593D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4a2a0c3e2e567222ab01484b9ce3f06d6135ca3f93eb982c597d839613b33198
MD5 4a3dd09f119fef43e29a5a82d83267af
SHA1 e0b8d13ade0f8ee1b1b2cb722f9bd57c22168f9e
SHA512 8189290b74e71c4ed4a11c730baa4ca13b6223275de31611ad84a01a6f69fbfce0a50a7fecc6715b54291e297c4710a2fd4c8200e6bdbda02d5afd46749282e7
SSDEEP 12288:loLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:l3NyBo4kx929bL3Hnx
TLSH
T1C94523125A0C623AF76D3FB0644A8098CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e27a0c6c6161276f717d57131ea7ad419550c15f939033228c82d1100190a3e9
MD5 0cd916f2f82e08ad6ef66dc0b5964ac3
SHA1 b0939d8ecd92731d8c8f25ec9771d5e7b755a1f5
SHA512 fed9b1029ee8f7f01408d841b87774e92b21a5b35bef32a495052d17367d90ad37fbf6449339264ac30eb53cdf6e4e262c2653c99a9c3ab778fd1ef98d21123b
SSDEEP 12288:BpsfxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2ONyBo4kx929bL3Hnx
TLSH
T17D55F00AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 836e7463699a6ddcc9ac991e56b256ae5d6cfa3dfb9f66c3529e4ffead46ebd4
MD5 13a1a0fb9c40f5af5bf822e0ac069030
SHA1 de3445dbf2119bfccd8e1fb750692427f8762798
SHA512 b9a0fc9da477879fb651623c6af19cacd35ca90c34585984ac73559a9717b1b68850196c9f0b6732fc2371fcf6f1b6ce1621d115d2a2d125a1fd637d2b3df090
SSDEEP 12288:4rLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4oNyBo4kx929bL3Hnx
TLSH
T1E3452312975C623AF6BD3F70645AC024CC39BC4D0F55D6DBEE1658BA59BCEA28E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bfa189f070bf53163437ce2e428cf9699ee2291d18e80176fd476b6121b408be
MD5 9fa3954bc7d5d2c0f9d381d8426a9dd8
SHA1 387aff74328c06421de64a5a5a69cd849eaf0628
SHA512 ec2281d56ceed040ffeed82a9c72a1fddea9cd79a9ea9e65cb964857387e3bd02484d1a29da46a5cd9b7b73d2aaaeac6f33d89e242379ac9a16bc987e38f67cb
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQFB+kn3Hnx:5a0hNYG4JwA+k
TLSH
T1C585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 67c387654151aee087f814b41fc3c9563ec62fd4ec5971a143c9f9435e7b2129
MD5 d08edbd3d9144bbf6ebdf741a06ddfdb
SHA1 d53f2c19c613fe9c425c387c4e99be5fb0e0f2ca
SHA512 9c5f29c445d0df8dc435be8a556d20e6b074b2865fc31ca938ff7eb934007d43e2b30fb1c855345695b30029bf9475bf67dec33d298f2a2664f96e8030245957
SSDEEP 12288:WhbHjfXILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WhbHjPXNyBo4kx929bL3Hnx
TLSH
T1E155123E16AC21E9F275B67C9546850AC731BC1A1B11A3EF6792817E0F3BEE10D35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7016659c8ef9385fa7ae1f470ff76f3c1e0a455b8483ee10e4c034af7cd72815
MD5 37efc492be4f290768cf66d4ff7b5efb
SHA1 a083435cf3493b870301d1633cd5829c6579f94c
SHA512 34a8b95ac5ad6bea969058ab2cd89f39cf33347f636a348e91a1397dd46d0f89bd2b7652487603ee2e7fac94479428d0cdf5c78ec74751b04fc4aab7d996cf7f
SSDEEP 24576:Z3YgnJcRTk4yti+R5dpR/fNyBo4kx929bL3Hnx:ZIgnaTk46ppR/wB+kn3Hnx
TLSH
T10345B02DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 67428052017da1894bcc645ef9a1b21aa08ac76ad99b8dcafb816240f38770d2
MD5 a0a571d687bf7ee449021d8e92286a1c
SHA1 089ec49cebd9ec30b4082eed8df841f087fe2fab
SHA512 3a62c4203a56964431f8e68a4761f951ecd70124817c26ea226b1064faaf7824af7f5e0d58bd759d0217e7cde51ca62e842f750a0d097e9e62247dec3059080e
SSDEEP 12288:aXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:asNyBo4kx929bL3Hnx
TLSH
T190452312560C627AF67D3FB0644A8558CC34BC4A0F6697DBEE66987B59BCEE34A30103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 c0ecc83cf2e8ff0301338c21068a13aa01d20ad78b318eaa290b3250372bafbc
MD5 6b4ec50ef81de3027a2ec51daf9ea2ca
SHA1 111dbed48100e3942f37fad2aea898eadc271447
SHA512 655b2e218d74528cbbec00d5ff71b63909a6f09f6795ab977ee5b963dec1700ca682fba7f086aca83d6400c66ab9f98b2fa4bf28307de145e088ac11282f96bf
SSDEEP 12288:dObFA4LWOsvAYFT2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6xL3UTVNyBo4kx929bL3Hnx
TLSH
T10F750115F79800F9E97B923CC8A68916D672B84D0764E7DF03A84A661F637E24F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 415130a9ffb3eb4e450eadb9a4f8e6928b4679bf351034adb87f6aa74ad055ca
MD5 588b234a9bd7633aa1a75d532a5f93c2
SHA1 3c8ece8acf2ee6ebb0865288b58186ce904259e6
SHA512 0348b6cfc80ea7d7312fd3ba0ce4c4a70ca83fba6c15c1907388af33a96ea3c88d2f6f1197b3adb7aea9f131a70df6bf77230bc907cd81c912adebebd91349df
SSDEEP 12288:HpFtuOCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EOJNyBo4kx929bL3Hnx
TLSH
T1AA55011A369C20F9E579767C8986820DC731BC560B2257EF46A080BE4FB7FF85D35A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d0247d004b9599f3959a98d2073f2a0785f7b6fa4eada0e5463e5a9fcaf6f6ca
MD5 cd41fba5e690c1ed70499158b029e749
SHA1 ccd68e364672c858249d979203f384ee71cf68ca
SHA512 cf6b12afb452d2aa53b61141d60ef09900348fe68e11379687d4fbd7d0516824a5af549d933c0b81b099780f0a59e825435c54ccd9632947ab3f0ebcd68f385d
SSDEEP 24576:f7NM9YmZqmWMUkPjZM48Mv6bEhsYNyBo4kx929bL3Hnx:f7cBWMpPjN8DbEh4B+kn3Hnx
TLSH
T1EE65AE2E6BAC81E5D477D13DC9A28205F6B2B4611B318ACF5162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ba4ca811554785c35db57fb6215a7e7cd7c1c5054c297eb7d6fe32753124be7c
MD5 ae576494deead088dc3a231e80101405
SHA1 52d2fc10dd350ddfe3861f88b3783bc404714960
SHA512 5d762ad2e3ddd90b1906b967d224c6c88b1b1e77f2335d7190928ae27197aabfd1262cfd55446caa2b47e1db57a38cf9b526794bd27495331d437c448b8f3b8c
SSDEEP 24576:NW6BApg2YuyuNDYTabvcRvNYf8km1qNyBo4kx929bL3Hnx:NF2YuHNETovcvNYf8km7B+kn3Hnx
TLSH
T18A858E2A27EC80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1828acbb9387219b21bf745afcb959f95b81aeede1afd919003d92ae137548f2
MD5 d4b19cdab3a6dfc3cf6d4eaf98efcac1
SHA1 4501936e14eb82a8caae0621bbb7ee207f58373f
SHA512 2b6733cb45b89dcd9c729a1c6a30342f429df7548647cffdef4d42598e63c38ffff7bfc6a37ba08eb4f6e2df8ca1767e1115836caf08daa840c055bcb95c53eb
SSDEEP 24576:zAFs06+OmlfkNXEbToNNyBo4kx929bL3Hnx:8Fs060lwXulB+kn3Hnx
TLSH
T1F465BF2F62AC00D5E07ED17D8997C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8455fbd91d31cf6a243fabdd8c8850df8e1fff23f7245586a5f051b95da28295
MD5 ec6259f175b5b449bf523e11f3a78a49
SHA1 21c90e203329a37e96360c5c48d3171be9b53041
SHA512 b5321c7157487c7a2373fba6a9ca4e4d34dd2c2e17a2dedca2a3c1254920a7be2dc914d38ce0cae83bcb1afc6142c50e7b0d05fff18a807aa2b1e2ee57788cfd
SSDEEP 12288:CCJnJ5D3VkrDzxbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DJnJ5D3WXONyBo4kx929bL3Hnx
TLSH
T16A75D02DD2A810F8E4B7D2B4815A1755FE72386D2F226AC76874D4353F22FE09A79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a89bebedf23cc805379ff7ec56d6cb2468a9269af029c42c755b43cf14ef75a3
MD5 67f88b9379030373eb084cecdce6be46
SHA1 f1c36dbf4520cc4dbfef62694daea12330f9ab8e
SHA512 12957560655d7f093cb0a077682d9e11a626f2c251bae59606533ef79f2a159180f94d9311656a00ea6922d4f789ed17cd7e49ad33eb19206889f5403330874f
SSDEEP 24576:qEPohm6/7IIXdwcXrif7qQncjlP65i3VufNyBo4kx929bL3Hnx:9o06DIKdwc+eQnSt65aV/B+kn3Hnx
TLSH
T1C4955C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e0fbec696e4644cee958aab02c3f7b55b8642a3c255f9d765313bce29cc7d057
MD5 546472e56dbb1929f5bfcc52bf252b0a
SHA1 6ca34a6c09af4ac231abf10e4ec6da4ba4ad4d00
SHA512 495e0133f27f19eff084e0bede02a187c1ebee0f0db267cb295f084e4476e75e42aef2ec2a56ffcc5897660d9807a91bb7e15832cc697c9359eac3248fcd0695
SSDEEP 12288:iEP3RlnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hlcNyBo4kx929bL3Hnx
TLSH
T18755122E279C70F9E13A717C94918104C732F4651B5267EF9AA2C17E4E7BEE61E38B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 08197f4a082b73f3ae12829395353a8dc569b0e572adeee166b99acaf5faa90b
MD5 337ab455f8110fb73730f2b941a456cc
SHA1 675a0ac2aebc695204db8eb17805e538ab5d0533
SHA512 8e35d02f83e8e7ca50fba6ebd495340f2b28a6453851dc52ea953f2e933bad625f21fd3cbf87f31a9b2ba321ae84d45bcd361af3000320ef4265f08e3683ce96
SSDEEP 12288:gjky4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gIynNyBo4kx929bL3Hnx
TLSH
T153551205638C61A9FAB92A3899678194CD34BC101F2193DFA591E93F5F7AFE19D30B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e864235eb66adf242297b36ac50c52bc3c899c8560bc1d5e07143996af7b2f3a
MD5 75257a24d1923ba08cd46493f0100d07
SHA1 2b0811a46206d11b41b3abec1f023598ae286d49
SHA512 d22a3bed5204bfebabd57bc1c35645c567eca58809f08ea99c6bd962500a752e470eef2370ae32c2e364570defc2b23d0b72869090b5d7538aa199f9a4acc5bd
SSDEEP 12288:NayLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:sZNyBo4kx929bL3Hnx
TLSH
T14B452319161C327AFA3D3BB0645A8554C830BC4E1F51A6FFEDA2D8778ABDED25A30503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4ff0ca3ef6490732d28e9553b20c60ff12991ff547faadaf9747f4d1b7fc8d14
MD5 61bc1b74be77e89a9abbde4f7ef9f5c5
SHA1 2f4fb8fe0ec6684c0b9161dbc919c1a05aa34b9c
SHA512 4cb781b9649d75398557fef45badeb6bb3ebfb22e2876a321cdf999dc4bc7660d467a600ce0a02ccb9fdda0e4b7f8968e3209ccf90b9cbfb0132b1b04c363915
SSDEEP 12288:DLQZb3C97GYnZMv5zBcKY97MD3jLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:/Q9MxZKdcz97w3wNyBo4kx929bL3Hnx
TLSH
T190558C2DABE9059AE177D27595A240C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f1846b020956c26570b9c9f1f0d56ef179509e68ade64a21a46da9b44e129b97
MD5 6d6c9e162f7e7a050b7d1ad5165d1520
SHA1 489eff742e3435efbc246a43cc054066cf8f01df
SHA512 18bc6fb30de30afc8fed42da8fba5f9e6b3f433e3acc1b934848144c3615d4fcf1d79a52a957a330b4a76a2bcc21ff1d4d2f1fd6503d7dc74037375cb81bf4c8
SSDEEP 12288:zyoKo29Rple9p0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zyocfAprNyBo4kx929bL3Hnx
TLSH
T10465E01FBB6D40A2E176923C88858245E773B4341B6253CB6691C73E4F77AE9BD34B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5417e9138f8be8fd60ad21285b8f17d9f775389ca8b2a0e6846046519efdca2c
MD5 829f28c9048697f2b1f743112e2c6d24
SHA1 39590920d44086e815812a5cc8add4fc755bd797
SHA512 d591aa0a85e1ca6998f7872b6333779d554462681de40b05a470c09dc2cd8b8181b8ddfb63ceb2581eb999f99fc3087c84ac9b128b24dec6557fae5261b507f8
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKkB+kn3Hnx:40zuNIc+k
TLSH
T178A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-545-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/344-355-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/344-356-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/344-362-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/472-374-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/472-368-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/472-367-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/472-549-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/548-312-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/548-310-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/548-417-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/548-551-0x0000000000BB0000-0x0000000000C05000-memory.dmp

Download

memory/548-304-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/764-719-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/764-546-0x000000000D1C0000-0x000000000D1C8000-memory.dmp

Download

memory/764-466-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/764-459-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/764-524-0x0000000001E10000-0x0000000001E20000-memory.dmp

Download

memory/764-465-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/764-540-0x000000000A250000-0x000000000A258000-memory.dmp

Download

memory/764-508-0x0000000001B60000-0x0000000001B70000-memory.dmp

Download

memory/1040-452-0x00000000005C0000-0x0000000000620000-memory.dmp

Download

memory/1040-718-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1040-454-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1040-446-0x00000000005C0000-0x0000000000620000-memory.dmp

Download

memory/2292-440-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2292-442-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2292-669-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2292-430-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2432-15-0x0000000002010000-0x0000000002065000-memory.dmp

Download

memory/2432-17-0x0000000140000000-0x000000014034A000-memory.dmp

Download

memory/2432-8-0x0000000140000000-0x000000014034A000-memory.dmp

Download

memory/2432-0-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/2432-16-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/2432-9-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/2520-426-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2520-418-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2520-424-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2520-634-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2524-542-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/2524-344-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2524-350-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2524-352-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/2712-553-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2712-379-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2712-384-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2712-387-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2868-332-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2868-556-0x0000000000BB0000-0x0000000000C05000-memory.dmp

Download

memory/2868-333-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2868-458-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2868-339-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2868-554-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2868-557-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3044-406-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3044-411-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3044-595-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3044-413-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3256-230-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3256-40-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3256-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3256-42-0x00000000006F0000-0x0000000000745000-memory.dmp

Download

memory/3256-34-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3448-291-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3448-292-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3448-277-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3448-278-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3448-284-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3580-386-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3580-267-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3580-548-0x0000000000BA0000-0x0000000000BF5000-memory.dmp

Download

memory/3580-266-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3580-273-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3652-68-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3652-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3652-56-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3652-62-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4004-136-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4004-76-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4004-70-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4004-235-0x0000000000CE0000-0x0000000000D35000-memory.dmp

Download

memory/4100-232-0x0000000000C40000-0x0000000000C95000-memory.dmp

Download

memory/4100-229-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4100-21-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4100-20-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4100-29-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4356-405-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/4356-293-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4356-299-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4356-289-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/4356-550-0x0000000000D40000-0x0000000000D95000-memory.dmp

Download

memory/4456-391-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4456-397-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4456-400-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4456-402-0x0000000000C30000-0x0000000000C85000-memory.dmp

Download

memory/4456-403-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4456-390-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4572-439-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4572-315-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4760-558-0x000001CD31050000-0x000001CD31060000-memory.dmp

Download

memory/4760-559-0x000001CD31050000-0x000001CD31060000-memory.dmp

Download

memory/4760-560-0x000001CD31050000-0x000001CD31060000-memory.dmp

Download

memory/4760-561-0x000001CD31050000-0x000001CD31060000-memory.dmp

Download

memory/5004-234-0x0000000000D60000-0x0000000000DB5000-memory.dmp

Download

memory/5004-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5004-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5004-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5004-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5112-552-0x0000000000BC0000-0x0000000000C15000-memory.dmp

Download

memory/5112-445-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/5112-324-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5112-326-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/5112-318-0x00000000006E0000-0x0000000000740000-memory.dmp

Download