87596cdc322e9e790398ec5ff59aeb306c58a3654d7705c1f2850eaef0fb9628

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_59d1f815468b12e0bd5f5a97d952819d_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 955KB
Sample260511-mkn8eaaw8k
SHA256 87596cdc322e9e790398ec5ff59aeb306c58a3654d7705c1f2850eaef0fb9628
MD5 59d1f815468b12e0bd5f5a97d952819d
SHA1 7e53ecabab1aaf7940d7d465162a6abf65ae26b3
SHA512 3cbd46bcd6de2379456efa07e3e0bd86efbba8a2eca26bf31caf5e49583ec3afef848a15ad51661bbd02cefb869dc4b261bf8bee31cbf94fef0454ccc3dc46cb
SSDEEP 24576:2bd6a2r47o0FsWnfJ4yL/tNCJPXUQrP6:2ZTo03fJ4klKXnC
TLSH
T14F25F159E7D504F8C177D278C9924102E7B77C8A13708BAF27A886572F772A09D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3236	alg.exe
4476	DiagnosticsHub.StandardCollector.Service.exe
1844	elevation_service.exe
4372	fxssvc.exe
1344	elevation_service.exe
4740	maintenanceservice.exe
4244	OSE.EXE
4168	msdtc.exe
4352	PerceptionSimulationService.exe
2496	perfhost.exe
2704	locator.exe
4156	SensorDataService.exe
3256	snmptrap.exe
936	spectrum.exe
1256	ssh-agent.exe
2708	TieringEngineService.exe
4612	AgentService.exe
3532	vds.exe
1080	vssvc.exe
560	wbengine.exe
1996	WmiApSrv.exe
1820	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_59d1f815468b12e0bd5f5a97d952819d_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_59d1f815468b12e0bd5f5a97d952819d_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\974ad051c8368bef.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_59d1f815468b12e0bd5f5a97d952819d_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_59d1f815468b12e0bd5f5a97d952819d_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_59d1f815468b12e0bd5f5a97d952819d_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff27659531e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a931329631e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b98d79531e1dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093bb3b9631e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c66fef9531e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000146b6b9631e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000373d3a9531e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000783a789531e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4476	DiagnosticsHub.StandardCollector.Service.exe
4476	DiagnosticsHub.StandardCollector.Service.exe
4476	DiagnosticsHub.StandardCollector.Service.exe
4476	DiagnosticsHub.StandardCollector.Service.exe
4476	DiagnosticsHub.StandardCollector.Service.exe
4476	DiagnosticsHub.StandardCollector.Service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2956	2026-05-11_59d1f815468b12e0bd5f5a97d952819d_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	4372	fxssvc.exe
Token: SeDebugPrivilege	4476	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1844	elevation_service.exe
Token: SeRestorePrivilege	2708	TieringEngineService.exe
Token: SeManageVolumePrivilege	2708	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4612	AgentService.exe
Token: SeBackupPrivilege	1080	vssvc.exe
Token: SeRestorePrivilege	1080	vssvc.exe
Token: SeAuditPrivilege	1080	vssvc.exe
Token: SeBackupPrivilege	560	wbengine.exe
Token: SeRestorePrivilege	560	wbengine.exe
Token: SeSecurityPrivilege	560	wbengine.exe
Token: 33	1820	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeDebugPrivilege	1844	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2268	1820	SearchIndexer.exe	120
PID 1820 wrote to memory of 4820	1820	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_59d1f815468b12e0bd5f5a97d952819d_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_59d1f815468b12e0bd5f5a97d952819d_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3236

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4740

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2496

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2704

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4156

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3256

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1136

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2268
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ff0004c38db63cd70cad97018918de2dc91d5ab1496394a73db370f4c7e982e4
MD5 1d32ded4fdc8cc8775e60aa032eb15d1
SHA1 ec8aea6827310fccdac14f4cf54158dbcc050c26
SHA512 f7e4091d2923255782e1236295eae1af7af09310fe23d8add855f8a79c6a8d4da1f25a786caffa8fe12c364079a702b8e0e9ee1127c743351512f225e236ed2f
SSDEEP 49152:Yb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnHfJ4klKXn+:y3q6mjBcfJ4k
TLSH
T136D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 303a7286112e72bf7895eb7694a24121b631eb81b486743cf7651cf69baf0584
MD5 9f82272e6e14919b252ec590865fcfcf
SHA1 bd074f7b873cfcf76ecc475eb016a1a19771c680
SHA512 1a2133609fb6731e91a8ec2720294b68a10cbf7fb153a3c2c7862228718c46c2c2db7d23546ecf739bf740906dad3c06a3e7276c193fc4eef540d409ca4bbfa8
SSDEEP 12288:n1XLsswWkxy2lRq2czAofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:1XYfDtczAofJ4yL/tNCJPXUQrPP
TLSH
T1E305F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e9bf0d3ef9ddd47a2fd8e7a7018c89efc42145e8caafa849c93099bb437f1e4a
MD5 bafdefe88cf7aad76cac37fa71339fd5
SHA1 96c84cd1faf3b0996d1c3c0f1c61495801595b2b
SHA512 ff55f6de5c2eb5b96c1046259d2646a505f16b3e0077182894631d313ba35b4df750b5fde5231c54caafb7b6a000869c43b1a51176f6e33a07b4e732a56c4d20
SSDEEP 24576:K0Le5ji0hmxhrMvfJ4yL/tNCJPXUQrPT:KPji0AzufJ4klKXnr
TLSH
T11135AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 16b5e4e23b96572de5a640e7d16ff672851df7ea137ea0541c5e4bf106410797
MD5 dfacc6d0db0b7415187e3e969a37e672
SHA1 202ba9fea8fa13abced6d55b44ad589bcc401e1d
SHA512 c1959802d128b30a1ba92b8e689aabfd3d3a8f0ad12512a5948b28f566a0fa16bb6a55be3873c2a77afdff5011bf31be20f900dd5eb1477815cb139998d3bc10
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWj6q8wyuJfJ4yL/tNCJPXUQrPB:7/ezSC6vUzPv+HjyafJ4klKXnp
TLSH
T1E2756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0ae928bf8c86a6916d23468756aabf4b3cb4c7fbf234c8a044db9034b17ee463
MD5 6bcd1585b858dadbfd64aa34dfe54608
SHA1 0e6d52122b553a5937383901e9bfb5050c2161aa
SHA512 2b22d8246da00eef20f2fd4662fa01fcc2ee1ff7529325a508632a96a0e3e8ede003a4d5669f079dd0ade06dc26db88724aa97bae15792e1b9283209757908d1
SSDEEP 24576:kVbqPb88hv/l+BsfJ4yL/tNCJPXUQrPR:kVO88hXl+OfJ4klKXnJ
TLSH
T118559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1c2e2ee941dfe6f6769704b1c985b9875a6ab893d32e416e2a181ce38906f137
MD5 d1f4acfce1c31bd58d9d7e649cd319d6
SHA1 bf203d78a064f27a5b698902b1785ccec05fd42e
SHA512 a7080b8d8a1195edd36f9d3c1c92516fccc499afa2a9907ba3c2257de5ca19f9baeb5debafe7966e85a9abb8c19cc7a1f3954a373a6d5a26258cfdde80f45be3
SSDEEP 12288:EGzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:EGzfJ4yL/tNCJPXUQrPY
TLSH
T1BEC423E751849486DF6A87F82A88F001C704BEC5562FA2E6CE82BC857FFC91A559C353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 825636a40162cd972076e1d14709af8ab01fd575962161073748b0b8be07e239
MD5 42b856fc6cafdaea0afef7c9d8c539fa
SHA1 a85e059748fc979a8ae6ca476a62e6657e7cd6bf
SHA512 6136e71deee42f81484474d2ab2974d48a612b376b56d82d42bedf7cc05b813d56034848fa7291c91fe6bbc13b99596b06744dbbbd7e66c65c40d8cec8af7e31
SSDEEP 12288:5eBNUbTVO86U0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:5JIU0fJ4yL/tNCJPXUQrP8
TLSH
T18605C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c56615243c9196a490cb4baf28f854b4f3bbe46f1c905fb90fc8a634eb462169
MD5 162e547fa89cb8c2dd5e3753592814cb
SHA1 772d066c846511128ad375307e4c05550d282f0f
SHA512 327891419bf5c0111e963c0519d6e406e7ac602e270a9f141d62b493dca256baba59f0bda01b74e5e9afbc8e6f7e32216095f5e336ac225489720953228b1a73
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THh:bQvGAdlCEL8c/WRNw5CZfJ4k
TLSH
T108266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c03e6f067ad1d6c2ff14831d4292cd260d95d6c7fd704bea9180577a38c259ad
MD5 e6784156ee330476c94ab60abc543e0f
SHA1 c606de25882428b6db52b077ae380faa318ce8a2
SHA512 eaa2828aea4537d46aa90ce0b1ff1e68bb051ee7e0cd1a0a424032b6ae10de12b780d9d0b6d0e7d3ba8fcaad246459dc91ec49769e2db28b9c452e03bf334c19
SSDEEP 12288:UAwSfxL/2Dc3mDLLmt0LDQewsAj+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWS:pfewsAj+fJ4yL/tNCJPXUQrPI
TLSH
T12215E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b50865b710a14890c9c02dbad6516e18be119a98e9e41c6a0a3b132f490dbb7d
MD5 cf12723c2782bf63687e8a9764bc22d9
SHA1 76fbb4261571490f88025973f941f8f38846cb39
SHA512 ea2a3f0bcb25043381835849d3252485c1a5bd5b66ea9ea111d1523384524ed87d29b3aa5906b25b77fa4287f1d901407ec0e66076abd12e5349be4f4ecf43b2
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH2fJ4:GUEtQevvqc2W1cpV20I322
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 77237ebbca6a58080454c3476e04c099e9ece00d8194a6148516dc9e54cbef81
MD5 380c69818201a2bf9a7f913963c8a519
SHA1 5db1adc0b8227dd3947e269d63d4583de4faa521
SHA512 a53643ddde94942f6140411eea8966406b4a02ad392e35008643ea4005f9782af83e946a8fda3ff77d3825cccc196fb095a100a274e119e3da29d20a8322cb0d
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/zefJ4klKXnV:soqtVjnmFfJ4k
TLSH
T194D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5edd1693b252d5bc83a12292a2ecc282059f8d42358ca9961b93b9afcb350cef
MD5 9ef20da185083a2089ff66ffa7014288
SHA1 e3a3996dfb000003f823983e94328a0db843fb51
SHA512 695c8b7fbdf14cec69ce6b3780ce42212acb864e3d852983c1854f12501460b46088443f6e2d093a15b842c7ac3239175f6712526c9ca40b8684221d08c80f53
SSDEEP 24576:eAhGL6IFoiwtA5l7S53lfJ4yL/tNCJPXUQrPH:eAM5Foiq5VfJ4klKXnP
TLSH
T1D5359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 080c46c2b3512038fbbc6bcfda8b71cded606b17622510ea482c6d66848f5fc5
MD5 6b87a1e6ed10e36073398e9ec13acbf3
SHA1 935d44cbf05a5141ace2e7a6ce57b999c1338c4e
SHA512 2d4ddf4baedfa4b58e9978d125b153610aaac7c8c6e3f4631498e5298219ed2b9ae4ab6e6500313e5ffb3617a601981bb16bd199c3f16a6ccd15088f88601793
SSDEEP 12288:0mw5HEjsChNEBFgl0WDm+CpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTl:xwuROW6fJ4yL/tNCJPXUQrPh
TLSH
T1CB05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 51f67680288c0ce951512e77c00dbc4aeef1d72b82843f43727103214cbce54a
MD5 5a4fc55bbeb548152e8f2f92b7d092e5
SHA1 d7f575218968ea2e7dc6e08d8532657e3cd62413
SHA512 f0b116cc13228b39c4099b61cdc0df2b65b96a08420328c5a044b5998856014871e935163cfdea45e558ffe4b5b94ebbd67edc2b7894cad5b41992c314a7786a
SSDEEP 12288:dyZ1IyOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:EZuXfJ4yL/tNCJPXUQrP5
TLSH
T1B8E4129B32D460F9DAA782BC8AD4D101D3217CD2273A53CF5A5195963FBBAC61D3C322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3c51028586025a96d97e73b58bfc2eb7b505affea9136a20eaef48a8848ff76d
MD5 c3c125c382090196db4b6d29d67b88b5
SHA1 c8a097d32831ef26779e25e40d7d59005606bd73
SHA512 92b6972218171f463e46a991576ac0d60123fb7a2af232cd6adcc058dd069747915570057a0c9e6118bb71c2b31daa90e315882183776d0d4790389eea57104b
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uy:xQRQyi36YOcPDLvw2gAf+PN3QfJ4k
TLSH
T112667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 26953b9864d6113166efb81e443fedd0472c67dd7a9580af723f7ab2eaf2ccc9
MD5 60840ec085ecaa5530e51b8a4fe977d9
SHA1 98475eb2c5600205242e634bf0b3cdc557a5e42c
SHA512 922bb3b65f9829696aff2bff2851d7392289931cd03a812bcee13b9f8afd8567d848f054ce7a7afb947d57c9bf560b06fecb59fa84e4b90615a5d727559b9261
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UP:KQRQyi36YOcPDLvw2gAf+PN3QfJ4k
TLSH
T1DD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff3da17ec52ea2a9107768d18a209a0c457081086915458a0aaccaef46b4dceb
MD5 c988e61da9e62f65f97700f4c1902220
SHA1 0d588434a54bfa3da1045ccc6dc795741bd1abae
SHA512 32da60436cf39beaf8ae2dfe0ba8f4e487e4d5b4b4b565eb2bbcc24d4151286ca05c58f2f41c61326187fc1caa6075e3cf3b0cf401cece41a4367e1c043ddde8
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0HfJ4yL/tNCJPXUq:y68Qg55nhkeWu7PNU3/ufJ4klKXn1
TLSH
T1AEB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a4067b403a59d1a9ac2fb2a3f0ff8d245176310e87951b72c80d62e1218fe97f
MD5 b31fc5310e4e8f052c515e646ba10db3
SHA1 79ab39c5f49c08eac78b6fbdcfc4192fb87d9344
SHA512 24c87c78c44e4080cd25b17b6aa353c6411198ee8be445b7d04ef7e760adbb89992fb096f3f7a585df2d047109abdde6905edbbf06404eb72bf664098c218a2f
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99u:Sy5112gYy5azzVvU69nLKnhZzfJ4k
TLSH
T13F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8ed33f7b1227d1a4721214b8043b9136b0adbda71681f28c688055a551eae36d
MD5 1ac64e78a26ff4b7a5f3ce2e4a6a61fa
SHA1 b037031a20738671fccfb2aaad2256cfb414e642
SHA512 62131f798c83f2618bcbd379976aa7c0935a25bd5acd61cebea0232856b45268b7de8d484eaf2ec1c1763ab02191040c491679459937c5bac31de3b9bbaebba4
SSDEEP 49152:FB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glYfJ4klKXnM:ru6JmIxd2dYfJ4k
TLSH
T1BBD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 da54e21a55672449aa238259cb2115fb09da3cafba7015c6869f9019ce96a119
MD5 e53a6ff80fb34a23e6554eec9bdd0966
SHA1 ca894fd4ea4c342d2a831baf77347bd331cf1478
SHA512 4fade2b3a3d2d24025f41a7ff46738b18b9e93c5364524bc9c424d23a493417e06f017330f9de604fbb95b63fd8551268b55783a7c4862eebf9088f460ce17b3
SSDEEP 49152:X1hpsNoJpF1A67U44CwH7R4xUfJ4klKXnW:XmifPqRFfJ4k
TLSH
T1E0B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 15bb64e7d84a1303ee7f493d79cbb5a74619038b9d23935cf4cb84a5695bffe7
MD5 fe2bda10a918a0727d3568e065a70c5d
SHA1 d653551c7fcf4652972ca4c64266aa45f3e199f7
SHA512 065c03fb32a9460059114834d7a4db9088341894479106b82661358f416edccf4747f2a5285356c7ee7cc53ab07d3783e7a4be6b2f1f2f52985a4a7f4666dacd
SSDEEP 49152:TSuZQIY0Be2KkRVtOnks6NMHqXfJ4klKXnv:R5dKqi61XfJ4k
TLSH
T1B7C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f32694e67df880aa4dd372bdae0542af8918cdab0d678f1bd2d7c4057b853545
MD5 9d0d59ff6e8573203ef642fbbd98a9b4
SHA1 11d5367b9fe0c65d82217eda3c58aff2d15fa602
SHA512 7c573ae530f94e60b13716874a4d0335d013110b81712f930a2bd7bee810ba12b7f7dab8cacf588a1a067387cffd21add3d913593b632232113bc7382c5f965f
SSDEEP 49152:ChtSn8EApI0figjgiDn0AP5wofJ4klKXn9:jX2iWphRfJ4k
TLSH
T1DF95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 29648aa872b949d39bf43cf8c59479c7b7546cca0076960894f1da66af45b7f8
MD5 4c632309446e0db92088949eb499c5ff
SHA1 d7cc8b282295b198ff462713cca6438522afbaac
SHA512 d4dbc223e5061714eb2f05333bf860bd43a3093737f2eeaf928768ad85aa22de4228b926c5af2760c1e22014d1832ff967444a5b6eedc133bbb411608940bb2a
SSDEEP 12288:Y7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:Y7fJ4yL/tNCJPXUQrP8
TLSH
T113C423AB60D5948ADE1587F81688F001C7047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 25914e8111584f61127cde516ca452922eb677423a18125e485b5f67775c9341
MD5 a23b5faef552c063cf84a2765f01ddca
SHA1 707ab1cfecaff361457cc5376169fd6ab39dd852
SHA512 455f01e09e560f798fcfdf7b32cc89114c7a2ce7b5b57a086f12b7c15d2a23453a6bfa6f012a12f91e53eb7b834a29f219f6f065d06959f3eb7c27866b782aaa
SSDEEP 12288:jyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:jyfJ4yL/tNCJPXUQrP8
TLSH
T121C423AB60D59486DE1587F81648F001C7047EC6672F62F7EE42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 343c91b29b7d85a77e74eb0f6578ddef18a98ba71880987c7968e82e13fbb67f
MD5 ca23222fe2d7504658dd21bbed3937a8
SHA1 fa9ccb1d4528bc5a9c2d0c51012ca3e0bb05a148
SHA512 2a2b87d03266e1b653f5bdd533366d234daec00ec6388ec4ecbbbcb9920f35713eedb4bfd34bc4a90f6654fe4be6c12287731d90b45952de8ba73d01722c94cb
SSDEEP 12288:VcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:VcfJ4yL/tNCJPXUQrPK
TLSH
T1EDC423EB60D5948ADE5587F81748E000C7047EC6672F62F7EE82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6ae407491babe1975d01a79827dc1681411e13c2ad552a22c6612675a665a10a
MD5 fdcb6ed80d9a1b97b57bb6325b2df185
SHA1 2108994b62151104e48154d55f955eaca7e566e8
SHA512 d951f8feec1e543a41a86dc0bfea8cb8515b660640d64758bc036dcbfba1bf665eb7ade2b2cc61390ca4c8617c085d9df8a988d172d16d3f47691f43f8af6c78
SSDEEP 12288:fVFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:zfJ4yL/tNCJPXUQrPB
TLSH
T1C7D42397219480C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d2067fac3ccef5b22ac526579b1a487c8037748df1ac0085c63ff95822a074c4
MD5 0ece88c5d678fb036091a28de0323185
SHA1 eba36fa0e24885729d4f1d516dfcedd0f7855cef
SHA512 1a550bb6b1b76eaa35f96e38f7ad2284e36da2bdfa8ce49950053180ef1d70436cad5aef9777632bbd69c40dc266c36053b3ebd95cd0c6b6e0588af81cc95c4c
SSDEEP 12288:FdfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:FdfJ4yL/tNCJPXUQrPK
TLSH
T183C423EB60D5948ADE1587F81788E001C7047EC6672F62F7EE82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 89a66bc3d6da8b985e87a64cb7a775bc849bc2510fe65dc55d24434d25fcdec7
MD5 0e983afe6a3cdb77303e9efceddb82e1
SHA1 355d0e4034dcdb8e70d3dfcc9524c1e4e403bbf0
SHA512 d5091d333342cbf8ab886ce4e38f28d63302c0c8e3dd2c229d4b1422320ca4497687f08443563e3419c016e7cd20d2553c5447e42a5be103e9923c14ab6d39ed
SSDEEP 12288:iGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:iGfJ4yL/tNCJPXUQrP0
TLSH
T198C423EB60D5948ADE1587F81688E001C7047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7abde5eb2a88b7498fe864df6b253fcc9b06764f25767dfbee600a220cf9c48c
MD5 723977236050018c359228f8c88ad527
SHA1 5d630b3fe9ece7e7889a726591a920a4bb09fb9e
SHA512 bb9f8cfd691cdc8ed908d9dae970c9fd707bc56b0774715884f4cdac3866dec9af4d3e6251cc39303d6e3454c59667d2ba4e4de2196fc9eb4a6f7be67c7c5940
SSDEEP 12288:2qfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:2qfJ4yL/tNCJPXUQrPM
TLSH
T1B0C423AB60D5948ADE5587F81748E000C7047ECA672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 70e001c8ab00baea9721ad6283be7574737d2bdfff46bdfc6d6eedd4b88cf476
MD5 0b8119e49e46fa8f4f276ea21b9cf042
SHA1 53f93e356a8350ee2f2ae13841ad26c534272a53
SHA512 dd7f940497d33058c3c3dd5bf392589afa92457f928f60cfd30fe3684d6a27d338bcff80f872fd473b590e8ef75d816141efacea465ef18a66331faf028b9c40
SSDEEP 12288:SiZwbDzzFEoS2cPvySfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:1ZM3zFVSOSfJ4yL/tNCJPXUQrPY
TLSH
T1740501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 bc6929fd8346759b4f3decec0086df7b0b79fdfaef39917bb338c35f546873e2
MD5 8ea28ee60688bf6a0d25b443643b9a13
SHA1 1d37ec55a87c7d94b706f40f6b4288e48c1f12cb
SHA512 709dfacc590f4f7f018ae1cc89eea0bf9d52c7d746962e347b2e07e1937792257d4b5dbd18fe99890f3a4e7dcd394c606f68ec066aaa37234374eea076855439
SSDEEP 12288:HnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:HnfJ4yL/tNCJPXUQrPC
TLSH
T1BDC423EB60D5948ADE5587F81748E000C7047ECA672F62F7EE42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 4be79e3a315f5ff968147bdb3fb040ce5f43892563fd4d23fe00f9abd06c1687
MD5 844c37f773ed4044a48a73a23d4d6e54
SHA1 d32abcee110a1825d53858c3b788104f8c90f0ae
SHA512 369ce40c1f8c81cbabc752a7ea6fd9ffb512055625d6046a63afeb618bb9a110034531488efcde216f9d4ea2e3775ede463bbc5f728c23f9fa952bb2ee5d087f
SSDEEP 12288:UDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:UDfJ4yL/tNCJPXUQrPy
TLSH
T18AC423EB60D5948ADE1587F81788F001C7047EC6672F62E7EE42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4dfd5e454369ef82b5eb5ae9093b75e895f6c28e77f4287e2a12d4fe19b21352
MD5 5883d20ade39c13eea77b585e856b9f8
SHA1 4e61ce41ac1e471c349dae36625ff1462adb6169
SHA512 4fb833c72b109e61168c4ae6750852a5736a2d45553c7709ce700b4735ee770000a27769ff5820e74ef614e6a29fc8fd78de8f36b257324b4dfe3ae0f3e067fb
SSDEEP 12288:7yPz5L8OfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:2zyOfJ4yL/tNCJPXUQrPo
TLSH
T1DAF4125732A130F9D53782788990A602F331BCB2072587EF5B9056B63FBB6915E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 23fd2688d8805418ac3202cb79c384a8dd1022ad9a4c90bdb5021aa15fdf987a
MD5 46b1aec759395bc7c8371fd8e0a1d828
SHA1 e200affdd0d407dbf84989a37af7f1d38bc0c5d7
SHA512 94c48d7e77dd30ddc886df3fc973d4ae1bffde9f79d29e4046334d3a204c954c01cc02593e78ae2e20bf76f8c5563c02170f3324ee09d3b2bcdf3a62b5d939c7
SSDEEP 12288:hnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:hnfJ4yL/tNCJPXUQrPr
TLSH
T1A4C423EB60D5948ADE5587F81748F000C7047ECA672F62E7EE82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5ef531c7886108a84f13ef6eab32d23ee1ad7c3dc93d7087445f027803e7d908
MD5 c5ac811d58285acae3e5414eb4cb4280
SHA1 d69904a707be756e9793f3fbe72f76b4bc0c7a8e
SHA512 d7adf1f2a2624cc0282c753ad0c956ab85bd594f4bd1fe7f7349cb3ccc23e59e608cd854157e3819b538ca11e1933f589acad9d5949b141a42a39819664930ed
SSDEEP 12288:6nfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:6nfJ4yL/tNCJPXUQrPr
TLSH
T1A7C423EB60D5948ADE1587F81748F000C7087ECA672F62E7EE42B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2ca30e3bc44842f00649ec8b324986d5ddc533aae6fe6f4b62e4e27de1f69c78
MD5 35a11bc672e5e1d7f39cc3124250f76a
SHA1 5147ae0b0a2bf7cea84aa34014c0a8af204d595f
SHA512 5ae663647db560eadd399d708c0b51f5de35113f1d4110462135a3c10a1a6518e65cb46a18b9d200a21cf2db3d4d565b14e1b8d02ee9e51e3c1131ee7a7ff919
SSDEEP 12288:VyPz5L8OfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:8zyOfJ4yL/tNCJPXUQrPS
TLSH
T1F3F4125732A130F9D53782788990A602F331BCB2072587EF5B9056B63FBB6915E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9f714d780c1759dd0ee8454dd2a0e65b287e43b8ebc34224955e768665bee570
MD5 5c56364ef43edebdf58e477acc270aef
SHA1 861fe18c5d68861ececb96390ce99b2f6c6031b0
SHA512 8eb81656ea91a2e5ef4276e16dbb9e83b601e492373b9ef15fd1cc5bc00739baca493542cad4339d13d6f43fe78c2ff2060483324a7d7f9c0a7c594b52a23f8f
SSDEEP 12288:NCd91WYoaLHF3z0z04PDvhMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTm:YT8aLl3z0zDMfJ4yL/tNCJPXUQrPS
TLSH
T18B0501A5B39018F8EC67827EC9549502D3B27C9A0770C26F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 dd2230950ba3d792163aa87bac49a9ad60664cf4c3f941ea6409efa59aaad9a1
MD5 285b20510bc75b9df3c3436c076aa717
SHA1 3817750d18229b9e4dd023de1ee4cecba017bf0b
SHA512 51f95effb2ab84d5bd66ef67c04be58162f2f1dc06546c29add734053fcf905e1fc2fc03338b0e42d6423f531d5a24a616f6a598c783c91fc378510cc9dd6556
SSDEEP 12288:Yi4e7+RdTfgwCHKy7GLbbdIvhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GG5:Y3rd9CHKy7GZwfJ4yL/tNCJPXUQrPq
TLSH
T16A25CF91F3E410E8F0B7CA758D659501DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 294b9c48f75509616c017e3bc515219d8c7685b2c8d731370cb5817e20e3cdd8
MD5 774fd95b385908913ee4ec1b8fc24559
SHA1 7f0d3e18b152704b3b0db5aad4a8b58fa5230757
SHA512 2b4fd19fb110505626923f9a5de273e25f78dde8e6c7956aed8b32420caf5f419d0fc84e6acf0f52ca086baa73019007c52ea39e63946e306a421693dcecf13e
SSDEEP 12288:v8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:v8fJ4yL/tNCJPXUQrPS
TLSH
T18AC423EB60D5948ADE1587F81648F001C7047EC6672F62F7EE82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2fd4b70603ae507ca423a4364fa30fbb995b6bf2dddee41a847b488d70c494cf
MD5 a4372ba0118e056c706acf2250210029
SHA1 82913ed004207e54f7f9e6e2b114fddb57043935
SHA512 c50424e1e116b42f0c0eba39d5bf279039264d7d9a9d319130792bb95fbc01fd8163ebc7e9b3477010696637ac5069ea8d611181c82d18814cd75347f4b2e6e7
SSDEEP 12288:qufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:qufJ4yL/tNCJPXUQrPb
TLSH
T16CC423EB60D4949ADE1587F81688E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 839ea528813e4fb6d2aec0460a58ff4b43588cfb04b7856f42c9c545e9aecc89
MD5 daec4d16179514221b0d8a9c7a802bf0
SHA1 8e206fa2f0b99482d627b28608de6f1926e6c0b7
SHA512 9f1c1cf0ee3158a9a535495ceade0511defe3b134d2052993a1137927e396adc1a98393b899e951e21cb17404b228ab855ea477cdb4678da1d58e9f2bd071497
SSDEEP 12288:9psfXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:OXfJ4yL/tNCJPXUQrP4
TLSH
T1DBE4015AD29441D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7750323cd0c26776975d06222793a444c4ae7193ae385c5295bc3efa63495045
MD5 3be4a1d13ca11484e487da00418e758e
SHA1 cfd870d9cf4866dcfb47b1bad038ad5ffa0f6148
SHA512 f40797a15735c79fd431044ec9acb7da9485f4b67feca32179c93d1f5da17818d3898291b9e6bb0badc60d2cbb38bbbe6f07ac3b3ff318dc47a01bfe0b9a2c67
SSDEEP 12288:yQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:yQfJ4yL/tNCJPXUQrP1
TLSH
T1C1D423A761D8944AEE7687F81648E000D3097FD56B2BA2E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9e8e81990e99ed1180bd390ccda17e0afaa200c0523a7b80cc8a02b467785642
MD5 0143bed8ffc905fd6decc490f98f349d
SHA1 6b77836fbe1b0a8edc10b26fd7653befcd15e791
SHA512 09504e71443f781d41d59266f91e053598175d29fcf2eaa9f5c91e0765ff950e75493098491c8e1eacffa5921a9b700fb590b5d4a0e767f60a491432d134ad37
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQqfJ4klKXnx:wa0hNYG4JwVfJ4k
TLSH
T18D859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 9dbff658bf8482e0cc554ad9e410b3af2ad0ce584efee5f955e2dbb68bc3fa48
MD5 7a7fb4968f60af9fe29974a5f8a73deb
SHA1 c2ceda30da65db9421dec0cd613ecd9f18978761
SHA512 de0774c24524b69ce4a339ad79e33cc51d29ba0bc5a092c8ecc030d042998f79e5a7ebd75f78cd5ed1bb5ac391e9e4927b87c341ab985da59ffd6da62ffffc1f
SSDEEP 12288:RhbHjfX/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:RhbHjP/fJ4yL/tNCJPXUQrPh
TLSH
T17BE402BE22AC20D9E571D2BC4684D106C331BC951726A3EF67C2917A2F7BED51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d2f8fe37c5d132e9ef3b16197d58c8f7fe0cad7fd38476482af85d4bd0be4721
MD5 3da78add7b2259599748df656e4df6ca
SHA1 04c5d8ce0ff858a88631949538a15975b259be93
SHA512 1b882578338b4cef455092d945a25434b02d09d29d5a3a06b57b959c20f3a9d0478f198fb1d30860ace0b16ad0265992906722ffeaaa3aea981d1c02657b9b8a
SSDEEP 24576:M3YgnJcRTk4yti+R5dBR/XfJ4yL/tNCJPXUQrPX:MIgnaTk46pBR/XfJ4klKXn/
TLSH
T14D45B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 d86ea2e99e67588f60a64013c7c2a7cece04531885b718fb5bea64963bbdb14b
MD5 53a54fdd2f412e30f6f27681ac9abcba
SHA1 31fb910b5eb49f4202d85cdd6a0320b81ec8ad5c
SHA512 ad5fc3df528dcd451f132e82b639a89349a77bc5117aac4ce827119c1b534fb105405457b7442bc240a850a3f818047c8d01c31ce5297e39f38288fb8d5f231f
SSDEEP 12288:kEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:kEfJ4yL/tNCJPXUQrPX
TLSH
T112C423EB6084948ADE6587F81648E001D3047FC5272B62E7ED82B4857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 bf98c48d50ed3287da6e7583d511a76f6cf2de4b88e812be708dca5c2ece5af5
MD5 861e33256eb54cafaeaaf726ab83b2a8
SHA1 64c0ed3bd7ac2170e0b8896586e204f6c64c2e8a
SHA512 2dea2cf5bac879ea0aade16784faa59cbcf88d5c18bc11f1ff9c84c4ea35fa7d007fc20fcae44e9a0b730174cb2703de525ec65b16f8520faa870bc032cd4861
SSDEEP 12288:uObIA4LWOsvAYFTTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:XAL3UTTfJ4yL/tNCJPXUQrPq
TLSH
T10F25F155F69400F9ED6BC23C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 4a7f81d9afadaa5adbae3da3cd0b2acf0f81f192c6c4e912ec238a9e4a7f956a
MD5 b4908552de8f2eaec4c68c09d02268b9
SHA1 d701c110bdffaea4fc0b9b5a80c14ff961dafcc4
SHA512 dc3b4a2cbf4a16eeac8977c6713678bb8e3422754d850787a5f88f7259610ba3656ee04a3db5387c54cc95b19b861ace699ea0fd3b324d56cee3c17ae4ae6634
SSDEEP 12288:fpFtvOHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:5OHfJ4yL/tNCJPXUQrPL
TLSH
T1CCE4026A32DC10E5D576927C4A85D209D331BCA6172753EF46D080AE2FF7EE82C39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b71a326d6585b01a13efa3ef26e3bcc3dffd237cb28a5ff80c4e89cbebf8fdfb
MD5 414f6498a5749acf2ecad00b6e2d9810
SHA1 89bd1b85b01c99f81ca675c7c3b544b1d5835689
SHA512 800320b8b24448f1c0e33ca979b3e63f511ae3ad11f598fa01044cc75a0e17de5c1687659587ef5635a0b78dd60c2bf6422885373f82a1eb33618056db356790
SSDEEP 24576:77NM9YqZqmWMUkPjZM48Mv6bEhsgfJ4yL/tNCJPXUQrPk:77cBWMpPjN8DbEhJfJ4klKXnM
TLSH
T1A665AE2E6BEC81E5D577D13DC9A28205F2B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1a81b0b0ee9d91173d99ac1617bc08565c765eada791ed38962a23b94cbee494
MD5 c51d7e9a241c2cf315e03819cc4c9679
SHA1 f89d2b489e35b07f7fa4d47f43f98bc03d353b89
SHA512 0e0af2aeb5adf5e2851be8acaaa2ae3709cf4bfba1d7fae81f4d82669f7413273d84a2b99e07fe1816b72ff20d9c5a34b664321ff813fb05d1d4c20acf756a9a
SSDEEP 24576:SW6BApg2YuyuNDYTabvcdvNYf8km1GfJ4yL/tNCJPXUQrPf:SF2YuHNETovAvNYf8kmAfJ4klKXnH
TLSH
T14E858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3015de38f95467f930ab116f6d4b1885ef281559bb70c43c0e1e7d605838074c
MD5 42e83e17a16619ee846bfec813a65f37
SHA1 afba7c815310ba7311bb07f037e9122d45b566a4
SHA512 c63a7774fcc41a14eae5b97452437ec23ce479358c07b2c8951f6067deba1c8187431991a98d72451f5b7b29a91ca9184356c522573cd79eea79490dae8cf91d
SSDEEP 24576:6AFs06+Omlf8NXEbTo7fJ4yL/tNCJPXUQrPL:DFs060loXuKfJ4klKXnj
TLSH
T16565AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 4796405394b3366a448c3208afc4e3209aec06993412d7f0dfb36228b2844780
MD5 12d45b11c202f9a416a3e4026e9ad4e4
SHA1 5cac185f635c3e542406f92908b437bec772aa66
SHA512 5cb183269b9d0f9920e5c3203d3aae24329dc9fcd7936e2f354daeaaf6c38ea3e052297fff18f77e3133947f75c680d4ed3087b941da3aa0db1ac65f37faa3b2
SSDEEP 12288:9CJnJ5D3VkrDzxAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:UJnJ5D3WXKfJ4yL/tNCJPXUQrPk
TLSH
T11515D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F16EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 eb50249a46e33ccaaf969157ffb8628f38d98c5e059bd7d6924d2abdbe66f451
MD5 7b2ce53d1657e71700f608e0f4ea64ae
SHA1 fb3972017e16bbc39f7624ee1676a032f0f3515e
SHA512 31c5e5a361867059b711675392282448f5bdedac7f0a73d8b2b36ae1608155a89b67bb252da44e47e34117788547f7c9b8d048bcaf6b9db4d07f3f93081bad5b
SSDEEP 24576:rEPghm6/7IIXdwcXrif7qQncjlP65i3VuhfJ4yL/tNCJPXUQrPj:Mg06DIKdwc+eQnSt65aVsfJ4klKXnL
TLSH
T16B955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5f5f26d4da64456818b8a45182ea3bacccae6c2b03bf698051c04ca3eade1a03
MD5 6bfda1d59e0621a9e8b3d5dc33efa9ec
SHA1 7390040c66c3623a6b493ee3ef17a6509984fd9e
SHA512 c2d390f7cba7cb3bf7ac7bb5da65d816d313b8a7102bb63d3515dc14e433e18e089e70f0ae8adffcc0096733aa43bc897a490bdd4466074e4e16b804d352f5b5
SSDEEP 12288:qEP3RnMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:JnMfJ4yL/tNCJPXUQrPG
TLSH
T14FE412AE269CB0D9D526917C4680C101C331F4A12B2723EF5AD1D17E5FBBAEA2D3CB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 ced988715ff230729884f08b981d018e04153eb57a051acad656bef99b0f97c4
MD5 cbc3fded1b7c531d718d13d711a0cf4f
SHA1 1a219af5cbf3791c6e5282640b8592efdd41f89b
SHA512 44fc288b15b30aae3913a7398ddf50212090604bf30df3b6839f7c1c070a0a30a0f63f20de0f0284fe54d2b1cc1f8ebaaf3f9711e3f0b60fc2bea05b5496976c
SSDEEP 12288:4jkyZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:4IyZfJ4yL/tNCJPXUQrPE
TLSH
T149F4224A23D4A085DAB647BC5A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 0b6e0b676c92f6e80a4e3ef077fa1bf396d8500cc26fc433517afcf2140c6eac
MD5 44684e0a5e5be80031a1c1b0ee2253e9
SHA1 69e4c42cda90a65286dabd20465d9b62ea076384
SHA512 561d29eaa5652fafe6b213957375c92c2073a89dfc91b5373f469087e016e1b2c79cdce7f95e3cab59900db933cd07b8591cc125915fdf3adff918c74f8a2b7d
SSDEEP 12288:Fy3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Ss:k3fJ4yL/tNCJPXUQrPX
TLSH
T1E1D423AF2095A089DE2687F81648E000C3147ED5272B62FB9DC2F4A17FFD99615BC792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 98c6fab843b9c96df1d58b935a59702403691244ce47d5326ce86dea2b703e55
MD5 f06ae6f8d085cb763dec089795403f36
SHA1 21287926718b7b24ee498a638bc65c19f93be026
SHA512 71732c60607b9dfe35c6261bf1881418e84f94cba1b1ee8d370fd7ef8aa7372729c5895c35fd0317c9e344ad8aa805ec3de008021f0e8315c1c3440ef27ada8a
SSDEEP 24576:xQ9MxZKdcz9dw3IfJ4yL/tNCJPXUQrPa:xVKZIfJ4klKXnS
TLSH
T132558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 58f090b7c287a931396fe9fa6ec77fee334b1a7c835fe637d823d92c7f618ea5
MD5 58d238f6cdb8fae9cc9fd258e0beaa34
SHA1 3ef3188a006bf1c37523f008ac7ad3c3503bd3bc
SHA512 610a707ca2c7caf25f163008d2d231e63da96cf5ede38483f0e3a35e720c0ebe55f312bb65de002f4b728b3198b8cd8a1d6755b28796af1d8bb36532c220cffb
SSDEEP 12288:SyoKo2JRple9pdfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:SyocDApdfJ4yL/tNCJPXUQrPo
TLSH
T16CF4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5175248046ce251e640b35ed90817c8f897d45d5408ab1def257689d254b8f39
MD5 438b49b848499150bdc158403244282a
SHA1 606bc04ce843f9d25b1d44a6599f32930102e1fd
SHA512 c9d1b2b87912541001451eeda03ff34d0b20dd0b6e92428c30fb7c2abd805dc03f2a4cf06c1fafe7a824f900d8e99ee4e1782e54a5e2a013a709f293c2119d32
SSDEEP 49152:dWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKdfJ4klKXna:90zuNITfJ4k
TLSH
T11AA57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bf9aff6329825f97281e05012637fa82fe4132a376f069657d2a2e759e8cfcfe
MD5 34aa715e96199ba278ff51acccbface8
SHA1 7dfa0400f00ce58b9503bc2f7301e19e880d5298
SHA512 f616c775bf50026169d539fbd60f7d6412f1d6613d4ada5078257f9d572dbe5a83d8d94e5e01587d182931f554806842de92a98cf827a00e8ef5a56d5ff72cf7
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYzjMqbMfJ4yL/tNCJPXUQrPe:3TDxR+N5YzTBjMxfJ4klKXn2
TLSH
T10B55B02EA7F855E9D17E85789A23C502FB727861033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-323-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/560-494-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/936-406-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/936-291-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/936-285-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/936-284-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1080-460-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1080-319-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1256-297-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1256-296-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1256-407-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1256-303-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1344-138-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1344-237-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1344-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1344-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1820-409-0x000000000CF60000-0x000000000CF68000-memory.dmp

Download

memory/1820-496-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1820-349-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1820-332-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1820-381-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1820-365-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1844-44-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1844-35-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1844-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1844-236-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1996-495-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1996-327-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2496-264-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2496-322-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2496-265-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/2496-270-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/2704-326-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2704-274-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2708-307-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2708-408-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2956-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/2956-32-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/2956-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/2956-31-0x0000000140000000-0x000000014010A000-memory.dmp

Download

memory/2956-0-0x0000000140000000-0x000000014010A000-memory.dmp

Download

memory/3236-232-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3236-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3256-383-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3256-281-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3532-411-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3532-315-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4156-493-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4156-277-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4156-331-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4168-246-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4168-314-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4244-70-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4244-140-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4244-76-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4352-250-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4352-254-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4352-260-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4352-318-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4372-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4372-87-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4476-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4476-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4476-23-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4476-233-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4612-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4612-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4740-65-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4740-78-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4740-80-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4740-59-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4820-417-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-418-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-419-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-420-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-422-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-425-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-427-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-426-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-424-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-423-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-421-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-428-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-429-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-430-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-443-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-442-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-441-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-440-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-439-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-438-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-437-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-436-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-435-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-434-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-433-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-432-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-431-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-445-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-444-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-446-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-447-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-449-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-448-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-450-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-451-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-453-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-415-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-416-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-414-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-413-0x000001336F320000-0x000001336F330000-memory.dmp

Download

memory/4820-412-0x000001336F320000-0x000001336F330000-memory.dmp

Download