7910447a45b93edb310b6a5e8afd89bb01ca8599a51bb69142db9f0709c4902a

Analysis

max time kernel
148s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_d31c4b8567297176c02c836b8709cdde_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 875KB
Sample260529-wfd2bady4j
SHA256 7910447a45b93edb310b6a5e8afd89bb01ca8599a51bb69142db9f0709c4902a
MD5 d31c4b8567297176c02c836b8709cdde
SHA1 465cf0cf29b823662acc61f9ef116bc421b74403
SHA512 861820e42b6efd37377b5646f8aadcde73b188a84f85d993e5fe121ccf0e5b727b94da3fcef71b70cd090abea057875527b54f02a0f3ad04e83944d125f8345e
SSDEEP 24576:eTh9vMB1dzSsqjnhMgeiCl7G0nehbGZpbD:okB3zWDmg27RnWGj
TLSH
T16C15E15AB26810E9D83BC17CCA83D60BEB763C1147309ADB17A096AA3F376D45E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3124	alg.exe
4016	elevation_service.exe
2348	elevation_service.exe
1896	maintenanceservice.exe
1300	OSE.EXE
2576	DiagnosticsHub.StandardCollector.Service.exe
1988	fxssvc.exe
4704	msdtc.exe
2072	PerceptionSimulationService.exe
4644	perfhost.exe
2456	locator.exe
4472	SensorDataService.exe
3232	snmptrap.exe
2144	spectrum.exe
5000	ssh-agent.exe
4676	TieringEngineService.exe
2728	AgentService.exe
4968	vds.exe
5020	vssvc.exe
2240	wbengine.exe
2980	WmiApSrv.exe
5028	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1f94012ffc4568d2.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-29_d31c4b8567297176c02c836b8709cdde_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008055640094efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f29f80094efdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006216c60094efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010ad5e0194efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b62f30094efdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002341350294efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4016	elevation_service.exe
4016	elevation_service.exe
4016	elevation_service.exe
4016	elevation_service.exe
4016	elevation_service.exe
4016	elevation_service.exe
4016	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
696	Process not Found
696	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2456	2026-05-29_d31c4b8567297176c02c836b8709cdde_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3124	alg.exe
Token: SeDebugPrivilege	3124	alg.exe
Token: SeDebugPrivilege	3124	alg.exe
Token: SeTakeOwnershipPrivilege	4016	elevation_service.exe
Token: SeAuditPrivilege	1988	fxssvc.exe
Token: SeRestorePrivilege	4676	TieringEngineService.exe
Token: SeManageVolumePrivilege	4676	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2728	AgentService.exe
Token: SeBackupPrivilege	5020	vssvc.exe
Token: SeRestorePrivilege	5020	vssvc.exe
Token: SeAuditPrivilege	5020	vssvc.exe
Token: SeBackupPrivilege	2240	wbengine.exe
Token: SeRestorePrivilege	2240	wbengine.exe
Token: SeSecurityPrivilege	2240	wbengine.exe
Token: 33	5028	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5028	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5028	SearchIndexer.exe
Token: SeDebugPrivilege	4016	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 3212	5028	SearchIndexer.exe	104
PID 5028 wrote to memory of 2148	5028	SearchIndexer.exe	105
PID 5028 wrote to memory of 2096	5028	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-29_d31c4b8567297176c02c836b8709cdde_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_d31c4b8567297176c02c836b8709cdde_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2348

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1896

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1300

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:8

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4704

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2072

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2456

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4472

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2144

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2368

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3212
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2908 2884 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2148
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2888 2852 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6b696c46a70073d87929821e167fbf54eed90a25546829203f44b93ef6ae1aa5
MD5 fd380d716ea3d1eee1dcfca6f2cb5ad8
SHA1 36ddb488901f669c91fc6e8570a843e5cf8dda8f
SHA512 17d52c22d2a460f55a33bdeec6c49e1064557b7f08e6b9bd6165baee80b989aafa2ed64527ea2d96ec6b8ce24d091c2244acdcf562172870f12123e8194b5234
SSDEEP 49152:Xb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn9Dmg27RnWGj:F3q6tjBqD527BWG
TLSH
T109D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a5bd14b314be574b301b17339d1f54a36aad7db008da069a3e4e2b6493dbe3bc
MD5 2eb97921548c8839277cd1375b8a941b
SHA1 afb45415347875f267eb46f1cb762fc0607e369c
SHA512 363f77609faef80bc5d2e7786715e0bc1f62e49b869f6bccf1e3f68386218c730658d97c92bbb221245934aeb9135cc0a25586a632bd40583ad671abcfd7b2e9
SSDEEP 24576:YXYfDtczAw7sqjnhMgeiCl7G0nehbGZpbD:PtcPDmg27RnWGj
TLSH
T1F8050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1c3cf153d4e5bd7ccbfc788c5b40c1725a72b6096b1cbe743750babab484789f
MD5 b8fa58e150d023481b1d0e193dcab8a5
SHA1 2d2c54302b87935c67b6c30258ad72b510c36b5b
SHA512 ea56bc583ef1a1d6e80e6a6a48fd3c0e08aafac5469f099c7c6f96d2090c26da041e7e95523804dad0f03d20f7f21620c0427d1ac94e6493d35b823fd75fefb1
SSDEEP 24576:Z0Le5ji0hmxnrMp7sqjnhMgeiCl7G0nehbGZpbD:ZPji0AxUDmg27RnWGj
TLSH
T13A359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f5dae3b5f286d8c9f039becfcd8c32935ae596e6d438e64edb3afe7b45baf0f1
MD5 58c59416556611bed1e210781a83f256
SHA1 120c050af6bf832ed87b54f790b3fa24245dd7be
SHA512 09e883c470ae0f3d2396980a0c7e41a274e284d79bae7a4f769507057af1e7cb387c97d27e1bc7361a3f46a00c83f02313248d4960e9b143782b888f00e9a40e
SSDEEP 24576:pa7/ezSC6vUyDZaqgrvWx6q8wyuX7sqjnhMgeiCl7G0nehbGZpbD:Y/ezSC6vURPvMHjyoDmg27RnWGj
TLSH
T1A3755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e37d695c52dbacf6162a28631ec5352481cdcc20424325dcc85a55933fc91ea4
MD5 193ef6fffc20e26323a93fea676dccd6
SHA1 2d7e1aaace4088e8b5d102148618cb59d6f8110b
SHA512 4a389c8244a8a8578832377dff1a012524b5b1140e4a4223bb95433c880adfb306ab6bc3d28b632c6830499b8e3e9d58214e18d1e0581cbe9337e3e496a17dd0
SSDEEP 24576:fVbqPb88hv/lV7c7sqjnhMgeiCl7G0nehbGZpbD:fVO88hXlVmDmg27RnWGj
TLSH
T1D6559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2c50efb13ecf05854948e7a7901ed8b4ba1ae0da56f7fcd2499f36d55d80e2cd
MD5 1481553f1ab454b97bacd6c92ba71ed0
SHA1 f313b014610f5165e03916df44be11d2555bf1ec
SHA512 1ac888d6ac369d249b94719bd185f9de2042a34d47a80bde47c3cae025d6d9714c7f8b1f0bd797856353e9eb13f595a93f3548e74fe79ad26458b696ae784414
SSDEEP 12288:VGl7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VGl7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EDC423BF824C11CAEA7608B5C3E9F11EBC137E56982008526A637DFDE6B5458CB3D523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5c3ba05243672068e2852c10e3a0acb32db2f1be3080f711d16ecbd5d7fc1cb4
MD5 028a21dd7a15bd513fd660443c0b3740
SHA1 8b4bb6a99b783c2769d47bf8047df827ea79b5b1
SHA512 a35226eef3ac258ae3e6bee99146896e7229136b69d15d4a2b009a1fd5396b1188ca8ba0754a37d812d5f975add1de95cb1a6da4ad77b4b177d6a0b5e563c71f
SSDEEP 12288:ReBNUbTVO86UE7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:RJIUE7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19305CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 229319b229488ef863a71f454f02c28d4ccc2ad4bf24c2c7268c324e46e6e36c
MD5 79e9835cb24450da6b06766ce252947e
SHA1 7431f72c6fb21b609ad32fe551c5a6f70c53eca4
SHA512 ea9f2426c22be10716ccbedf7df02e9f831db938d8038a7f9090c1c7b90607b600632946f9968307066b58837ca7e31bd560f64df869c26d39f4e1adf9ccaad0
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THp:qQvGAdlCEL8c/pRNw5CvD527BWG
TLSH
T1E1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b4d069de400710aa7c4a5a10f01c25021d77bb1d67f1a9cee00afca1757bce11
MD5 684e63840a7287d337b2b9f8f996830b
SHA1 37d1a621bf0539e47d6b1d52a01f26d4a8786398
SHA512 8e6060525785c5e3d54ca92abf5e996ea947fb74adeae5e929d1c402348b7d590d6719c470bfdd16214d542545bac2cfc1792836a09aabb6b2dc3d1f57ceb5f9
SSDEEP 24576:4wewsAj67sqjnhMgeiCl7G0nehbGZpbD:hljkDmg27RnWGj
TLSH
T1AA15E031FA74E036C37B0DB60B76D71A282D79204F6119C3E3E89D9E99702D1277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57071f93176078eb7c049fb6baed9c9e3e041df24bd3fe6f3a494d42008211ee
MD5 bf7d10ae3a6f25852d6f1d1e5f57545a
SHA1 e0125ae5340471463aed0671258d65cf6e7867fa
SHA512 a0a1089da0328f108a31bccd9b7ac3a583fd84ea22f80ef248129a15da82f8401eb64f0bdba211c71ceddcdadaa65e6517117b32708ce8d0f9fe6a756abf7ca3
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHMVQBWG:PUEtQevvqc2W1cpV29I32TB
TLSH
T16C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f8d4099b997939189af07d23853f3c2d0be1acdb22e6a8d54340dc064b3aaeec
MD5 8537d3c8609bfa9997a8489dd6fe3ada
SHA1 d8b3c0a7db8cbeb1981d2af5fe4a3e4e7fc15e8a
SHA512 ed3f918dc21c3ba8dbed7932a83d26c28d1bfb3f77096f11d1d77831bdc36b2e0eba1120c6df85bb7c44ff95a5a70dc4e3c88f9eb4cff4c2e6c63a2f959fb339
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zEDmg27RnWGj:koquVjnmzD527BWG
TLSH
T181D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 12767783feccae3db6de3009a12810763f564eb0ce77b1264118a3637c981995
MD5 bed655d37ca6aa90cc5bb288763c8d9a
SHA1 74e6d61b35e5ecd4180d9704dcdf699cf9818586
SHA512 927711ee2112e9192b857759dc59fbd1a64c12ec5a01836ed1de667c8a2408306247dcc03190afa3a3e286ce1257556451afaf58e8fe774b9f9eba77e6d8a9ea
SSDEEP 24576:hAhGLmIFoiwtA5l7S53L7sqjnhMgeiCl7G0nehbGZpbD:hAM1Foiq5DDmg27RnWGj
TLSH
T132359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 da15d11462b326f4eabc331580e75bc78ba0c707677e94427c1af4ae427bdfab
MD5 96c368963e70a729cd44675706fe118f
SHA1 70e7a656095fe041057a7bb086aeb1a704f10181
SHA512 1008c9580245f5c90db68b099bf967532cd252dadf0c3ab115939dbbc74ecfc0a5405971b3d241fc9df29ce8f3227d8ab13f37533dd26faf911cde1f1b24420f
SSDEEP 12288:Nmw5HEjsChNOBFgl0WDm+C37Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:owuXOWe7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA05F14A72A81CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 9debaa1ff88a3b3020eb092cbe134c28307566ce83929a61200b50eb3c06da87
MD5 b7d7dff4073822ee79fdd852082cfc6f
SHA1 ab1952afce84959f57803183a3065b23e7f4c689
SHA512 c9fb195a5607f9246ab1ba955ae32cd6dd28ac91d15664bd1710f83f439494ced5d647dad38403d063e28777ec28a2f340e2e0e9354c0a687cd7ad5812424a6c
SSDEEP 12288:PbZ1IyK7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DZux7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T180E412AE239820FAE163417CC6E5D609E7337C62673043CF166655AA6F73AC44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5e3dc4cb525fd4f23fea6203a1c0f2fdccf90c397cb5cc928d6e6b9de0c9f097
MD5 273a3d047832cc8553df2fee602f9adc
SHA1 4bfccda4cb24e9d28935e4852e76cf2236eceb11
SHA512 3615317efcc56edce6e3fc62bb9a080735e90a1bebb0a4873c7c92ab123d2a72c14b46cb3d0831b2f668e5ae90db19d35216f7a739f457ba493ec78feaef43b6
SSDEEP 98304:7QRQyi36YOcPuLvw2gAf+PN3WD527BWG:KQyiKakX+PNGVQBWG
TLSH
T15E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d4f0797172eacd084236543981dea323c412a63731d75578d0fb6cc5bf4dc5db
MD5 274c6a0af13be3d74aba8a9f06fc7932
SHA1 6a50754111b435fb4c59421fe0bc924dc7df941a
SHA512 42f335a5567a46d0db52846b1093b156c4bc3d99c141986853cfd84fd8417d07744337a2100710e147972c48074b27466851ca16a72ebbcae778610d7f6a6988
SSDEEP 98304:+QRQyi36YOcPuLvw2gAf+PN3WD527BWG:lQyiKakX+PNGVQBWG
TLSH
T15D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b7877dec75d9897491d038ee55437c5579644eab1b1f84d9052e409580b2d8f8
MD5 bd2cfd35848b70bb236f2e4aa5999403
SHA1 e332903ca21ea3bda4b9a2287983f6225348cc2e
SHA512 59d84ce5576275114c5fbb2fdb375b57cee46ce7c3eb4960e5f250db64a23e219afd7ce9e36a196fc67f8a518918d433305bdab4d517b1b9462bbee7ce57b2c2
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0h7sqjnhMgeiCl7j:T68Qg55nhxeWu7PNU3/UDmg27RnWGj
TLSH
T1FBB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0025c4b6938b9f422125223f6d65f00abe03ae0e54d92645eab5897428eadb7c
MD5 1cecab9a6206842de39e485c5aa5b3d5
SHA1 bf4e18dd605867cd5aeda95c828b0d3e2b6c16bf
SHA512 cc0e7cbd479b3b6bef458d967376b2fb8980e93bad9869c75da45dbb32eb26b3b8b4bd6e25ce303d7b56a57c9d8eb1ddf9001de6bb1655ce99229cee13309c99
SSDEEP 98304:Ly5112gYy5azzVvD69nLKnhZBD527BWG:mLIH+Wh7VQBWG
TLSH
T10F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5a3931616f2575ab17018fe45ebd068ae97ce4ac997bef1ab62026ae8f17f267
MD5 cef81ac153476ec5cad74fe8f6878cba
SHA1 be4f12700e43e7380a58f8bc1d0d62d0a96f04ad
SHA512 3834c10b7be53116b3d14576f266b74230c0e3a05ebeee7518cf9a67e34eb89d31be174c4553549061edc9f7916822fe62b174fb3108901d525255d322d1d0eb
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glODmg27RnWGj:Vu6JmQxd2dOD527BWG
TLSH
T1A0D59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a0037a15b2e25d6724f65d681ef23f5b8016ad688de628a815d7cd2cd99e4ae4
MD5 6a543eea4f05871727db4be04443cc1e
SHA1 6d73a7a399630473a4b605e0d3786a77f17ab33d
SHA512 6ed37b72800a5f29c9a799282d95d5a26b2179544fafe24f96d65e4ba749313eaf614c74ba08ea18ca7398c6d7a5fc13f0a78e864acd503d7eb86325663ff42e
SSDEEP 49152:O1hpsNoJpF1A6yU44CwH7R4xSDmg27RnWGj:OmifPVRzD527BWG
TLSH
T12CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 86ab7a756fb6c86b098cde2a815393c2c8cbbb86b230ee74e87c536326cc9676
MD5 719dc3db1d4ed42d1bbfb6041467976f
SHA1 8ea78d12228e1589420b261cee47edfc28e58b43
SHA512 86377b4a3e436d52e767069444fe5e1a9427865687ad04905b56cc84cf400483d6e741a337254cfdbd55e5348a31f42db56596302034ddef74fd2342cea32c7d
SSDEEP 49152:aSuZQIY0Be2KIRVtOnks6NMHqNDmg27RnWGj:E5dKOi61ND527BWG
TLSH
T160C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9575206b6654e64efde3d80f64be162241ad88567b79c33974e6ee28f43c0878
MD5 3e9f17434981c8d156ff61ff3d1c5d22
SHA1 ca88ca5b496d93947c708fcb81dc5278692e479c
SHA512 979f387c472cc6d9ea9413a381408ea3ac300b07873cda2cc47b12f0ba7ff9e4069b00e958f8d1dbbd13d874aa15ec55a5f0ca4be08891a43a70491f4fe52dcb
SSDEEP 49152:KhtSn8EApI0figGgiDn0AP5weDmg27RnWGj:rX2i/ph3D527BWG
TLSH
T15C95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 faaa21f6f394369c13249f8f753f0e87ddc254cc91b0a319f800eb57b7126c42
MD5 d93d8519d667360c3c3108b822574d27
SHA1 83fcdbfa058281c020b78ac0cd2b1a502781190e
SHA512 f1fb60dbf5d6ab5fc09df16733e0baa8f49d6016c04b345f920ddf3b3e0b3d8f4e95eb19c034b6fc1e3e8df8298cd3dbb2d5570c9eff34a180798627e1a393d2
SSDEEP 12288:Qt7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Qt7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B7C423BE914C01CAE52648F5C3E9F14EAC173E57E92004937A9B78BEF7B14984B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 34e3d0ca58e529a5e881d38c9a2c2bfa16b0317d2e095e40eaf4aed33759590d
MD5 930a43a3c9b5d907b5210645fad1b86b
SHA1 4b73bcf46f0d8be0ebd2d00cc7018a79d539b9ef
SHA512 bbf0ed95e74a4d75d5b12ae3f70ec677256cf11efecc9ccf44c05bb2216abb7fd0e6e660af13b232b25d82cebfeff21cd0201b73011a4d27cd963b9fe51e6b5b
SSDEEP 12288:xW7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xW7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A1C423BE914C01CBE52648F5C3E9F14DAC173E57E92004937A9B78BAF7B14984B3D826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0346f4f7221aa81feefb143f098c09c53202a20e352e5e7c4098cd7cd920cded
MD5 82cd7821a08e19a406e1cdcace121687
SHA1 a202fa5daacc1b34c11292d62e3a226db41e6730
SHA512 15064f15dcb9ce325066d23720239c23fa12c37874af404ecc394a965ed7bf99cab6ddc02a6b52fcae60352402f2a4ec281aae09aa37d80a6b8e7721e464a11d
SSDEEP 12288:OM7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OM7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14EC423BE954C01CBE52648B5C3EAF14DAC173E5BE9200483BA9B78BDF7B14584B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 389f94217b67f1131150aebebab09b66610c0c23f67df7f57226fe5e12661f37
MD5 a6c7a19a1c4f64a14e61b82d265f86d1
SHA1 58b963a7e051284397a57b5b179ce967fb08cbb7
SHA512 95f4a67b56a2f48af41afc3e91bcb6bac9d210dc30b32cd0a28d164bcd97ef13cb566d9092b9e39c250cf186790e92f40e3ff3163776889747024b95d300750f
SSDEEP 12288:yVr7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T116D4236E535C00CAD47685B4C2E6E11DF8237D56EB3005DB6B5328BEAFB16944F3CA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 06d8e5128821309fed7e24ae949171470aec6a37a219a95ff49f437c9f3855fb
MD5 5d971be6d5ae0f74f9aa0e98054508fc
SHA1 238d7a5cc9362f90bc5e9d53da994b836e57dc82
SHA512 ab5da002361f6a0a001e4c8ceeebeba7f9efccd7ce531066d14a079a5b197b615b4c039a3bd839cae949d6af8b29ff140295eeb1649b25e6a8fa9d0e13d86ecc
SSDEEP 12288:Yj7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Yj7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T127C423BE914C01CAE52648F5C3EAF15DAC173E5BE9200483BA9B78BDF7B14584B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f025abab2048b64fa8beef8afd19d07fa6173d67b3bf61da254b6ff30f552b60
MD5 f97f2abd29d331cc76acf51676b8e8e6
SHA1 1e81e949f981888a5b1e6c75043bcb54fadbec09
SHA512 31d5ab3d8f58a5ac0b82102100c4775cd75822e63da479f1b6cb8ba974f3aedd9de89826fa90f80aa4e31a09a69012c3b83841b2879e02c294c9ed3ac3574bd4
SSDEEP 12288:QC7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QC7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14CC423BE914C01CBE52648B5C3E5F14DAC173E6BE92004937A9B78BAF7B14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 61a4033f8c1bf23ebaadf4f5c997aa2b24aadcde34628ea712a1c8d7ac55171f
MD5 e43edc283dbe0a408e9f83fbec3c2b0a
SHA1 3f20849b4ee6bb2a45ed67a04f6a27c88eb182dd
SHA512 bd4d890ee4de99b1d50e8befc2ef34f267f4d75b1f59cf0ccc6c0fc1e6b7d365a2c7109546c743d6f0a9a2dd609c109df345f24a3eb27821ad15f3f366c0ff49
SSDEEP 12288:LO7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LO7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17BC423BE954C01CBE52644F5C3E9F15DAC173E6BE9200483BA5B78BAF7B14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 671dc2b6ee6d6ec48feb4527b8dd454c1a7419f71695164242f94bece064a0aa
MD5 e33cb310e5ba63abea692e04f392717b
SHA1 1b040d229f220e40c61763c779a902d95bcb5c07
SHA512 e7c857bb786d9a851c3f1a190a740c62acd315a50d7404bce55d6e0f60b1bf7ba1caac7ef793ec674996f180cb9f2e47ccb575b660bf49490995e2acbff51704
SSDEEP 24576:+ZMJzFVSO27sqjnhMgeiCl7G0nehbGZpbD:+ZMJzfsDmg27RnWGj
TLSH
T1820501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 70d200bca5ce30385bbc04f319e1aadb4962e01ee05c0a86e514c0fdc5b2c883
MD5 b891bdbfb34db28c59bdb5addda9beba
SHA1 0f026885048840c180a8a988da9178376a7b9e4a
SHA512 b0b4ef1b1d19f49edf41561d61b7029263d0f4e84d18c5291c547a42f91d37bf6436e9dba87ca917b3fae9ea70372998744186d2677ca91781a3d786668711db
SSDEEP 12288:8B7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8B7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BDC423BE915C01CAE52608F5C3E9F15DAC173E5BE9200483BA9B78BDF7B14584B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5207fe1eefb0977e202dc126868d3e0464390a324f435b44d565c6a7a4365378
MD5 a0e5226738c976b326a110c9b9a78d3e
SHA1 4ad72e353903cb6e2a43bd44717243b746a711a3
SHA512 e819c6944ebe9c4844c28e56dda29578665d23057e28fc7f4e11369407fa41fc6b8f7d6366262ea43a31dbba807cab100dda7bff18edcd794c56c99d89b337ef
SSDEEP 12288:317Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:317sqjnhMgeiCl7G0nehbGZpbD
TLSH
T198C423BE914C01CAE52644B5C3E9F15DAC173E6BE9200493BA5B78BEF7B14584B3C827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c6c37b830e813098198d0a4f4278056ea0305146a10c6ef8717001e15f28a270
MD5 3b601773513f36ec88471ee14d0816ae
SHA1 6f13bda590d3735b252e18541ce113e1d921f246
SHA512 ca5c959ebcdc91db6a0636b6e7e5623f2f72c5c112c8714ed7519ef48549c9bcf5fa828c5b4693fb33f698aeb7c723111eaba8cbb24b3564e6d2aa16a335d288
SSDEEP 12288:HyPz5L8K7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzyK7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11BF4025B73A530F9D1378178C5A29A06F7327C3647204A9F17A516BA6F336908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 17b397c3487b37a688b27e734df48db18b7d3b202554a271bbb103d5b22f0765
MD5 ee8f1d03e0e86820751007564d2d4065
SHA1 d658e23924c1bccc0b40ea597a382d215292395e
SHA512 60deedadadfc817e7cd8592f527270f2f1ab67c9da53767a326f38f5774c80b423c0706e0705a9820e278cf08e9de4c2f08cc68742b52dd9c27b80286849be77
SSDEEP 12288:GB7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GB7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D3C423BE914C11CAE52608F5C3E9F15DAC173E6BE9200483BA9B78BDF7B14584B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a29bd9219440b23eddb7103425454548d159bf745660c2ea65042e4586ffcfc6
MD5 c7ab059e20daac68ecf54ef291c19420
SHA1 6049d797c3b296a2d2a9cbf55887e81e1140cf4f
SHA512 ed3907cd8a1bb3d2c0b547102fad24e245a9f7fc46d1bb0dde0132156afa7ff87a43f63db237fdead114b6b0ac50510049c268dc9cddfe421ffbe3c55638149c
SSDEEP 12288:qB7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qB7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T189C423BE915C01CAE52608F5C3E9F15DAC173E6BE9200483BA9B78BDF7B14584B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1402b30bb0744e3a9a2864bc5069bf51e287b031a66f1601fb3bf22fe99b5711
MD5 94238eb2cae756df684861eac022157a
SHA1 df3438eb01f78d19a373dcd2e0c67a168d9cd89d
SHA512 c8b33a325d0422489f1d9a8673b2a13a3913a14e54b46adfb328ade7707b980b8e4546d6e497e953b1f757dec5f75c71e4f6447b1068ee3efab7682a02b87843
SSDEEP 12288:syPz5L8K7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1zyK7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T129F4025B73A530F9D1368178C5A29A06F7327C3647204A9F17A516BA6F336D08E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e025cdca0ee7c4be6118fe405b3ec1ccb37aadeae658ae3f233ea0deca923404
MD5 f6c75be60c699c3f45b3737a810e8507
SHA1 b45c7ee5988b9a75237419a74d7aa6762f31e358
SHA512 b379c61aef670e72f267aed06856b5abb8f1205d1e80254536739db4fb967beadab6a9ec92b6bda02a9bb0f18fca10c38cd1a531cf44b364d91ee478721cf778
SSDEEP 24576:oTuaLl3z0zD87sqjnhMgeiCl7G0nehbGZpbD:oTdLljfDmg27RnWGj
TLSH
T1D40501A9B35018F8EC67813EC965D90AD5B27C5A0B70CA5F13A4366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 6acf689713c1b9c765668600027c429eaac10dfba7e1a851701362e36b2972c7
MD5 5e2304c974ffa8f4cb1ded1b57fe1225
SHA1 e2ada24de4feb61cb7d5c401ef261eee3dc87717
SHA512 3b82ff8adfaedca0ef251ed83808776618abc2abf593dfd97f572403f101a6ad7422d32e84dd74a2b2d2ad489a50ed89378f10bf65b5764d44614c8f9d89e1a2
SSDEEP 24576:a3xd9CHKy7GZ47sqjnhMgeiCl7G0nehbGZpbD:8xd9CHKyasDmg27RnWGj
TLSH
T1F825CF90F3E810E8F0B79A35C9769511D9767C5A5B30DE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 26dc5dd01f6d8128e3b11b44b08f0a610593b65b79a2451b5611031c2c3ac939
MD5 f236db03b2c357d13ccfc3778dbc686c
SHA1 b42dd0c8861891c9f5751979860fac1acbeaa56d
SHA512 bea162f1723d9f3fec3e19620569c40168cb11b5cd13b2b7ef93db0fb49ff50863e74a660cb4e58cd3a6ed6f71da74ce1ece87f69ab5c531c1898fa1dcd58a96
SSDEEP 12288:4s7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4s7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T114C423BE914C01CBE52608B5C3EAF15DAC173E5BE9200493BA9B78BDF7B14584B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4809998d0f621ab6d68d5b023cf602c640b8bcfc4522f753133372cff7179cff
MD5 da82d4b2a6b573f0c360b13878e5cd10
SHA1 25a09a235f506a617d4c78859df86a2205008368
SHA512 fbf092234ed9196a42d37498a9cae6ed7ce759fc1a94ac2497c91f9917c52afcf2c8e6cadf5a9c3993ddcdb0539ba061c736eb5a11f64dc5eac250559f100522
SSDEEP 12288:qq7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qq7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T178C423BE965C01CBE52644F5C3EAE21DAC173E5BE92004837A9778BAF7B14584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b26764540db4e598d201397daf672bab5bd54ab49abd196fece9109374cb2945
MD5 8ba9c57377581ad4588c43be9ae6ae99
SHA1 04088c0bb45cfb8add5f27a9b68e325ee57d4a51
SHA512 d829e8a2b5bc2efdbd02eb21abc7bc5917f7c6e6463d1ce4796c00ec71b7a85b5d0787b908c295549e0258848bc3726aebc4a6b3c6faaba21327010ed2a655c8
SSDEEP 12288:tP7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tP7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T152C423BE915C01CAE52648B5C3E9F15DAC173E5BE9200483BA9B78BDFBB14584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c76859f8039d0a347d1426a94f0b53fe33402674aeea45301e85f6d56c53e74d
MD5 6c4c74a1145d1dc2ee5f94f12960cc1b
SHA1 890d4bee6309a0920828b4a49c1a08d6bb69e775
SHA512 d35d62c10d6690ca23faf2628c163a07878f677e3a638fa66f54d12340bf5e01b7bddaab7e5a27517b42c318edbc54a7c14279d79dd206aaa7017cbeafcf6970
SSDEEP 12288:8B7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8B7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T182C423BE914C01CAE52648F5C3E9F15DAC173E5BE9200483BA9B78BDFBB14584B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0a30a134e215a691cd26ee47861e6e9716c231c42ebff8d846ae0001d57cb639
MD5 bddbc7495afae19955cb071f6300f00a
SHA1 25f0ffcb0a7bc6552483ae9fd9b7dfa6227e1938
SHA512 107650c9538007f891373e5478dba0dce9a7192eb9898a77c242673b5b3397829c507bc8a75acc6f7314ccae3969275132af81d33006a4f49b9c4d6c74ba9fe2
SSDEEP 12288:yksfx7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Yx7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DDE4015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7b81f33f7019d507b5d12ad8a152177174f8e758c5761edccd9aa72d6a0a73be
MD5 7f4d9a075a1516d0e2e5ede6b9a35373
SHA1 eaf389bc879bf0ff0d1a25f92d41c6addfde76c4
SHA512 c2ef5670eb4369a4a0fff593f6137085a3ad5ea0f446fd18dc9040e5cd8e760433ab72caaaf95a1745c964ab7f50d6022151ff1e48ced868cc15653c0fa9dd51
SSDEEP 12288:y+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DAD4237A834C118AE47A49B482EAE12D781B3E669F2044C3B94779FDF6718D48F3C917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c70e0d1375f04078ff535c3325cd1f73632b36507af23514a3cbf8e02bb9d6b8
MD5 0a14e30cce6749eb081088baf2761f44
SHA1 e554e67530b2f73ae31a25fd9b76cc7c91487aac
SHA512 c914b9ebd8cc7ad1e4adbe7bbff096df4fb4cf9aafa9a65cde8b0870d79f45e3ec18f79c138d7566bb4b1886ca4412a47ed15ec5cf3a77cea83f6c8e67d2be90
SSDEEP 24576:g8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCEsqjnhMgeiCl7G0nehbGZpbD:BRZwQCyiHiQEaiPnMxDmg27RnWGj
TLSH
T17C85B01E62DC42A5E0BAD2B8CDA74407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 0be3e1ff7c2d95ec3607d78cf691ce7b8e5a01fca1ed1aa23a42812a407672dd
MD5 f7d768c228770c0c6bf8d372558bc324
SHA1 d8edb18062d0297261983cd4bbe357da9fa82477
SHA512 488e1a1bb34f207f8fb923c91a3c5a2984ca02fa874dc94af531ea08a92d445bfcb8e0c09c256d603ace369507e6dbeb7c16c001504ac985d0bdb419aaac0906
SSDEEP 12288:SbxA1U7KOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SbxA1UGOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T194E4123E529C10E5E176957DC6D2C10AE6327C26672093DF21D282BE5F37EE84E39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 eba211f2ab3a171787d590ce55e27492e5b8aeb0eeeb24a019070ffc8e5b5fd2
MD5 9ce1b086b4c457680814b7998349753b
SHA1 03a740309f62be8fe5d76399b6e36b05ad0c3f90
SHA512 d157eca1b69fb104f341853c55eb5418a7b23083d18f6812e06186f3d9904743626a91b50cf57a2e38af5497bbc2fee35bb16109a580e3056d128c5717f68506
SSDEEP 24576:ljsmP0yHaqrVqHra44KDzMsrnPsqjnhMgeiCl7G0nehbGZpbD:ljRP0yHfVqzlAsrnzDmg27RnWGj
TLSH
T15045AF2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 14d1234ffe7881017ac2b7942687aa6445f6c7533d18cfcbdee1224684f823cb
MD5 ce9db59b5840778b8e3531689b9e6faf
SHA1 82b247d7aa72f0406482eb75271d4078a41b8f87
SHA512 215277592c027e345fd9a3691312e9e790fb825181ac3a7dbf26090358f7d9a3e5ff9420dd2d21f8432a36a20036aa907bb1ea3644b906917241c755c58de2d2
SSDEEP 12288:3MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T171D423BE924C11CAE92649B5C3E9E11DB8073E269B2004D3799778FAE7B54D88B3D413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 18a08ccf314cfb05f53e054b97044d723b643e1e1c9280dbee9e986c87614352
MD5 5845e0a423bebf53376b108391e78585
SHA1 e56793c8b9f64424f112429e34940520f4161336
SHA512 8c98b4280107d2a7cd31bee31986d158b309374e6239a4fb42ed25150abf08c574fc05a13cec92e7c7a7a799f60400711d789dfea769c70685532d2f1c38fcc1
SSDEEP 12288:nObZA4LWO+vAYFTyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ItLBUTysqjnhMgeiCl7G0nehbGZpbD
TLSH
T163250159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 9a2b3599688a1a95d4e13395cc5e62fdb17c19871a3acb735b14964c92273b03
MD5 ed6dd36354fea8a4b9293e4fea9088bb
SHA1 c5ec30afefc4ac5c3441defa96dae21b32ffa6c2
SHA512 7031fb24359c4c0cd0c95a6594586280fdd251c0b790410cad40ad9b0c7d7e2af9cba9314045b7c7aab24dabd0d40d357887ca1bac28a8576030b7aae5f36755
SSDEEP 12288:p70Vm6IYNvUyBphXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:GWYNHDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11905E12E92AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 600c2dd4228641eaf60a0345d4fee50860eb43137856295243ae153b6d74ef59
MD5 57d28e0c24f5ef78fe51cf676fe9a472
SHA1 ca10241802891cfbae3e900aa79f6f1bf62704d9
SHA512 e120f4397c57b6f74799589e1ac2f464552daf59df9de975ab5275966357b73ad8e37f8139385d8c031771707315efdf91e591ae8240781d6713611fad99c939
SSDEEP 24576:JnXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKv:JnXoJJYH84VVS6AmEvJas+cHBjSSKHPX
TLSH
T18A65BF6EA2BC04D8D5BBD17DC5C29506F5B278621331C6CF026182BA7F27AF45E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0bf3acc4775128e18c767c2543d9a7a108c5c6eea9428a23a0f4f14cf68a8e6a
MD5 b1918694a925f00e142ba8c8cd6f3ecb
SHA1 da5793cd1632eab168c6e4132d5241a58edc2621
SHA512 ed06924598ad15c42eaa8f222e0179257c8e3f4c0f5267e2bedd7f5da4c352b06148407aaf3ac96e9cce8cd62969c6fa4ce2549673f51fe602d9e6a9c9c780db
SSDEEP 24576:qv7Xbxd9Tuycf8M/TYlSuxrr2PCpsqjnhMgeiCl7G0nehbGZpbD:qDLL9TuJ0M/TYj2PYDmg27RnWGj
TLSH
T1E0858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 4c60146f5ce2a964d0ef54689501aba5c45ea6bd6b114fb8d20be46a160c2f19
MD5 1d05565a505c0d1f59fc8130ec5f954e
SHA1 201665decb70ee9bcfee6857cd057ac9fa76545e
SHA512 5dccc54cfdf81f9344eeaf6844b100175878e8a410df4c2dd52c789056a4600303dae88fef42c111205ca221cea44867a0bb86c9932068a9869dd616654c2e22
SSDEEP 24576:6egJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10wysqjnhMgeiCl7G0nehbGZpbD:6ngOJOmPOHE2Dmg27RnWGj
TLSH
T1D955CF3FA7BC15D5E03EC17D8A928916F6B1782603255ACF05A0827E5F1BEE42E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 5846dc2cbabf1e10bd284516f25103bdc6df4ba72ec1421dd18c612ac78d10bd
MD5 60034606aeae1ac6b94dcd76b5254861
SHA1 6d586e4770a8274627eee18b16f7fd5e53fbf54f
SHA512 df4c3317541dc79aab8a1621aef7676962455c81d7564dfbbb1b4693c0ce9ca81fc113f214b3067122a8d4524a6b9e4dbda7164cbd8e46671f08a486a6ae0e00
SSDEEP 24576:DLJnJiTk3R3waE4JrOssqjnhMgeiCl7G0nehbGZpbD:DLJnJK8R304ljDmg27RnWGj
TLSH
T12C15E03DD2A810E8D477C2B4825A6756FE32387D2B2169CB29B4D4353F12FD09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3e6d43a77b33a23274366ac6b0357c2058381cd259111584bef789b4bb7d43ac
MD5 540c5e67915e46b1498ab9efbaeb7dfc
SHA1 a9aaeee7f8b24bda36ac03882fd64cc3f068cf4d
SHA512 786d0d048e01d32b8d592be8594c5c2d6208bdb309599c43485005a311614ee5a606261ed8517b5d2bcbd95dcb10c45b47c88d23010e85e70baa034529838ee2
SSDEEP 49152:a9mqCzDScAZmlvTcFg8Ph6UDmg27RnWGj:snD527BWG
TLSH
T1C8955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 4d7e8421cbf41498160326ecd1083427900f26a156805840eb17898fb97186c7
MD5 3450f1e186aca3d56ddda8ae10d5b881
SHA1 8e382602e651a16168076dd63d76b288d6875b20
SHA512 6bcd54dc0031f5213f7f6517f4998730c5b2abbc05f1470e8c53bd3c89e5507d7c9537ceb78377b8544f9a2f44215058a706ee0e08b8d856b20c21e206b7e883
SSDEEP 12288:GlYJeXm5nkEUuEDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:GlYJeXm5jUuEDsqjnhMgeiCl7G0nehbo
TLSH
T182E412AE669C30E9E13A8079C2E2C508E632B872571017EF55E1D5BE9F679E40F3CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 0f4718b5d9f06f4506d9285c311a7b6eb33ec8c29a83ff86e4cbe2dbb0400dcf
MD5 65e3f23d20ab16203e2c7c865e97803a
SHA1 c90531f34988108a066e8d799bf04c1cfc46b4a4
SHA512 e18e4eda803dd29852636eaccf946a9d0c38c12890a1ac2372220fe5f82a540cfa630acfc04f1ab68d58d91caa04be2a6fe94f1897ce036f11fbff3f01981fc8
SSDEEP 12288:Wmu6kyvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W7tyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T114F41219639820D9E9760978C6A3C158EC367C219F2046DF65D1FA3FAF72AD48E34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 b3b750313c4f17c781dd46f21d29541fd7fe6b9f295d1e207915073cacce2616
MD5 378dfe0d01997fa6bfb8cd85588deab4
SHA1 9ceb34de6f48b4ac4517d0f79d417b2fcedfceee
SHA512 6e65ea97aea6d67ea387224640790383148ae523482e1f70f08d40f5cc48e897bff43c7dd032474189b4bf59c36b2f66094c7e2db6e67f147c2c777a0830602f
SSDEEP 12288:SPyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eysqjnhMgeiCl7G0nehbGZpbD
TLSH
T15DD423BE525C20CAD92244B4C2E6E11DA8173E369B2014E775E7F8BDEBB54D48B39C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 00109b7a0b8bc288a15bd52705aacc7ed43dd836ff99c3f4dd5297580d1c8d5a
MD5 af71263edc5058c7293586f43ec41fcc
SHA1 005d2cc2b08cb4b4cfab0936ffc5b6503ba78978
SHA512 85f81e913bf45c976e59278e041d97a0d829bee024d0e85fbdfa01fb3a226fd995a24f4524f06f89967c6872557b2bf591db1eef297dcf8c42d3e2bb93675fef
SSDEEP 24576:lC+TyQIu93VAumZr7jmVsqjnhMgeiCl7G0nehbGZpbD:l/TfIq+YJDmg27RnWGj
TLSH
T150558D2DA7E91DCAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 4c72078d35f6e698224f7506b10da266b4e0cf9e92422172367142e75fc395ed
MD5 cfc014623dedcd7c276141e0332794fd
SHA1 9716ffed71f66808923d0ad9c6bb3fe13c45cf18
SHA512 a45e866e521bee9136fdd5a5260e95e8e7fda65e2d6752dea220b258a0f49276b92d427a4d731521c0ff2c1e3164b753573c65943e80ffbe6448398b68b246a9
SSDEEP 12288:+cyrWOstaa3kcsGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:nLQikZGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T131F4F11FB3AE0096E0A7817CC9858106FA737835571163DF02A1C7BD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ad1bbae29854292415637956a07005c4156be185ae406851012379933d70b73b
MD5 964579369cc825f21729072ea99d240c
SHA1 71dc8f3a4036c60ce823e02a048621f54c21a0df
SHA512 ab2ed98845db1910de1463d002f31aaa7eb0863724e5aedf5a08a71be1a1cd18562aad0084348531378953837f3efa2a742a96b3f0d346664df4a72eaef74556
SSDEEP 49152:MpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPTDmg27RnWm:NpC7b4+80GTk8D527BWG
TLSH
T1A3A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-75-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1300-228-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1300-72-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/1300-66-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/1896-63-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1896-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1896-58-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1896-52-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1896-74-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1988-253-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1988-269-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1988-259-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1988-247-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1988-246-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2072-280-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2072-274-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2072-273-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2072-393-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2144-330-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2144-332-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2144-510-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2148-534-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-521-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-527-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-525-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-531-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-529-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-523-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-520-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-533-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-522-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-519-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-528-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-526-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-524-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-530-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-532-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2148-536-0x00000199AF7B0000-0x00000199AF7C0000-memory.dmp

Download

memory/2240-408-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2240-399-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/2240-518-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2240-405-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/2348-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2348-41-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2348-227-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2348-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2456-12-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/2456-297-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2456-9-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/2456-21-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2456-290-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2456-296-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2456-0-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/2456-419-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2456-8-0x0000000140000000-0x00000001400E1000-memory.dmp

Download

memory/2576-235-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2576-242-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2576-356-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2576-236-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2728-373-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2728-369-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2728-367-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2728-361-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2728-371-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2980-420-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/2980-411-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2980-417-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2980-535-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3124-15-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3124-25-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3124-211-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3124-20-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3232-313-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3232-507-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3232-320-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4016-226-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4016-29-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4016-38-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4016-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4472-309-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4472-301-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4472-307-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4472-424-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4472-513-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4472-514-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4644-407-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4644-284-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4676-515-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4676-348-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4676-354-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4676-357-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4704-262-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4704-267-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4704-258-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/4704-383-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/4968-375-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4968-384-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4968-516-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4968-381-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5000-337-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5000-511-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5000-343-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5000-345-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5020-387-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5020-394-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5020-396-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5020-517-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5028-426-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5028-432-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5028-505-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5028-425-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5028-489-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5028-473-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5028-574-0x0000000140000000-0x0000000140172000-memory.dmp

Download