9496f7e8a0ba394f0fff608030de657d21e794a94dae4faa27dfffe94b63ad69

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
Size 1.9MB
Sample260701-blympady2w
SHA256 9496f7e8a0ba394f0fff608030de657d21e794a94dae4faa27dfffe94b63ad69
MD5 01041cda28ff891b4b64e0c1fa3f5464
SHA1 592d1ac4ec47a552b370c4e884b50186fed9155d
SHA512 2b62be682cdb4e821a621698469cfd5649999c5e13419730ddc39d454361ed847cd0e6ed796a7f0fd45be5e612e914d803d0f6f830d5f2e915d11ad436558274
SSDEEP 24576:IxDawlOjwGXgXe4i7ojhsP5Lgrk1TWb4AN5:gOAOjAe30jaNf1TWbdz
TLSH
T109958D79E6B844C5E2BAB53881638555E222FC09435196CF3A687F063F77BD4FA7A300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2688	alg.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
3772	fxssvc.exe
4232	elevation_service.exe
1388	elevation_service.exe
1868	maintenanceservice.exe
436	OSE.EXE
3604	msdtc.exe
1124	PerceptionSimulationService.exe
4896	perfhost.exe
3396	locator.exe
2592	SensorDataService.exe
3080	snmptrap.exe
4012	spectrum.exe
3828	ssh-agent.exe
2288	TieringEngineService.exe
4392	AgentService.exe
2300	vds.exe
1820	vssvc.exe
4188	wbengine.exe
700	WmiApSrv.exe
1172	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fea718cd7c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000872ada36f708dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b34bb735f708dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042605137f708dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d0a3836f708dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d1e2c36f708dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2208	2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
Token: SeAuditPrivilege	3772	fxssvc.exe
Token: SeDebugPrivilege	4308	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4232	elevation_service.exe
Token: SeRestorePrivilege	2288	TieringEngineService.exe
Token: SeManageVolumePrivilege	2288	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4392	AgentService.exe
Token: SeBackupPrivilege	1820	vssvc.exe
Token: SeRestorePrivilege	1820	vssvc.exe
Token: SeAuditPrivilege	1820	vssvc.exe
Token: SeBackupPrivilege	4188	wbengine.exe
Token: SeRestorePrivilege	4188	wbengine.exe
Token: SeSecurityPrivilege	4188	wbengine.exe
Token: 33	1172	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1172	SearchIndexer.exe
Token: SeDebugPrivilege	4232	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 3664	1172	SearchIndexer.exe	130
PID 1172 wrote to memory of 5088	1172	SearchIndexer.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_01041cda28ff891b4b64e0c1fa3f5464_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:672

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1868

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:436

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3604

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3396

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2592

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3080

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4012

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3828

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4184

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3664
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3a531862b53ad39ef98358ffa80b89369294c12ee42c03be1e5c02d113ddf8ad
MD5 3e1bd139656f13bda02e178c898f6096
SHA1 b19d86040ef5304bb6a4f1b8a5824725e1f92da3
SHA512 7a847b3b106c721d39d272bb8d805342ddcaca0c9c40e8efbc28ce94a5a9f9afdb711d26d14262ebfef74e167e1282d1b31837066fe0d3d3ff4bfeeee95a0cdf
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnPe30jaNf1TWbdz:O3q6HjBKU023W
TLSH
T181D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d3801c4cb8d89f970e591a27d107c192fb1f38f8c529a475d8960552795206b9
MD5 b58caa6f4d08d60657056ed1229fc8fe
SHA1 ed9cc5ce4f464fbcc3f2ae387bffac77c75bd983
SHA512 e6709a3c18b19ad567d917bc42e8f02363cceae46e486933e950ca7cfb03f30e963f7bf165182efe5d72c285a14d3682f36ea8f95280ac707bf1f208a55d5926
SSDEEP 24576:JXYfDtczAHgXe4i7ojhsP5Lgrk1TWb4AN5:stcRe30jaNf1TWbdz
TLSH
T11085F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 7800458cf617b9f7cf948af96653652e5c2bcf074f7adbfd480dc2923d68eae6
MD5 9b7cf551d3521be7b5cadfe1627689b5
SHA1 70d77497cc23545c3b63eaaa0c531b77c5094fb8
SHA512 b71eed0aac585ffb35f5477a88819acf9a3b5bf9ebad957af9cf6c6d2e9bdb40d5a600ee0351c872979285215039901569d573e137b47ed5d7036de5e22adf5e
SSDEEP 24576:W0Le5ji0hmxXrMwgXe4i7ojhsP5Lgrk1TWb4AN5:WPji0A50e30jaNf1TWbdz
TLSH
T13DA5AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1f791c077feae8f2b7658634c3d91486f574b627eec39917d10b3963b0e88325
MD5 2139b9fb752a773805b0725226486b72
SHA1 fdc68a4d7d7b95ef98887dd774b0ef0e246423ee
SHA512 1aef7c11e6c6b7c4893268dcae31da795dda1994b0c173257326e2b0d871ce5f680d147666747fd039ebe51cd2a47f41e8fdb3cd4298e2e6e5350ba23ed86e41
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuOgXe4i7ojhsP5Lgrk1TWb4AN5:s/ezSC6vUzPvxHjy4e30jaNf1TWbdz
TLSH
T171756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 97707a97e76c9acfb61e2c5d23fa127577e5f1a675d62c45a41e23d4061cff51
MD5 cea2d720f1281b3c374da6aacfb7d83e
SHA1 4bdfe3dd3aec88d114db0071bdc13339d0b5bd96
SHA512 fd7299512a7b732a864f4a1e8f99b41f8a48c2f811d64fa7529a8d45be3f9920a62bfaac7c5c90ff09b48eeddd9240b35171cd64963d3cbee372a67466506fb0
SSDEEP 24576:PVbqPb88hv/l+6DgXe4i7ojhsP5Lgrk1TWb4AN5:PVO88hXl+be30jaNf1TWbdz
TLSH
T15C559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 a5ec9d9d1fa5cc8a889d61253a2faf154a3ad577bec5492d62f7952b2c529ba9
MD5 4c169b5117c19093aff95d2051bdc7f6
SHA1 1ffd3b0a00fbe6d008a5118de0f6b4f469c11af9
SHA512 e1b6c768309a5ebb60f17119fe940c956d810383e1fe7d897a9d68e67ae0c8e2b6d65cbe206ad5c2effcd194c741f3057381a275a2fedd51290151f39a761d09
SSDEEP 12288:I3v0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:I38gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1827523929F5409C6F38FC3F4A0F7CBD1E9E11EC061448D6B47E0BAA318BC899DAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 d85df9da40524293953c78720a2e2e8dd0923a0991e3c03c830bd4f9787b81e4
MD5 fa4739d533645006f4aeff15953ff6c6
SHA1 535cdf96e9870c4d982651a20dafa0e96a65054b
SHA512 d94e27a1a5faeee95964f073cc5f6f09123119985e88dd8cbb5d6cf2232f1c22e2dfedb96724627b944f2138d304d32cd9fdc3aeaad8510809c03b755544e689
SSDEEP 12288:feBNUbTVO86UC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fJIUbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A585CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6fd2ca55e7ebbacf4441b3e3de73cac723e93362764f78f5eecb8fe89ca54ea1
MD5 96926df4f8f2e5f1b6990b412dc8fe5b
SHA1 04816409644def6bbdcb080d6ac2442303dc0567
SHA512 926883fe643906db44cc14f10636ae0a52972c951a36871843a048d15cca860c721ab2c3f5adff3d2f0745a0140d0d734b1251353ca0f3f66c3cff5bf8bfe3f1
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:tQvGAdlCEL8c/yRNw5CxU023W
TLSH
T13D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 8889e3d5c23848d42dbeb773c9a33f04565b19969b690c1f215c511c52ab144a
MD5 14c4c614beb7c89f111000979cbe118b
SHA1 f6746eaf40daa8d2fbc3755315a8322cd66a3bfa
SHA512 d5f12690f0e6583345d32f6c4e254931649ee6b032d6c0444875023ca0435450a16fd02f04ef5a3fe71d646b513c0201e3933f10ca031683807e68af1f44fa39
SSDEEP 24576:80ewsAjZgXe4i7ojhsP5Lgrk1TWb4AN5:tljke30jaNf1TWbdz
TLSH
T1CD95E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5b80e5997b55cd54773285fe78ccd6d7c8e476811bf3efc93069b2223840aff2
MD5 ecd6297e3c1cf5de27b95c5eb0e4db65
SHA1 781fefdb47a597f8f169aaaf8fdb4edb6390adad
SHA512 11b31d15fe0389ed1ae33e829aadbe59fa858102ff035b5d46126d8204522948b79fc6f69a143ab48e7f1a839214150c2a30d2cf4ab59b7658d521de9ca4358b
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8p4W:NUEtQevvqc2W1cpV2EI32c4W
TLSH
T161474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3f2803bad74858c20276420f4e4f1ffab862bd2c525396096c005c0bcbc788ec
MD5 a36a0c7b7d819aee929328939c019806
SHA1 5a96d5693fb3a03890940ef05609d9b10cefc084
SHA512 b595f9bf47eb46ecf36d12d1a05a143e39fc418ac8dcf2213d244f1829770f21342867f4d5d66ef6129750b19a8a1f7f0e37c42f71f36a35069b66259ed995b0
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/zEe30jaNf1TWbdz:DoqtVjnmFU023W
TLSH
T156D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 aa7024406895fea6af678e9a8ab14a2a374914a3176f2c12c433ffe9c4a32139
MD5 0654d82710c6a893e5f2335cb6c9a0a6
SHA1 b1dfdaf6e81aef5f027ce1b2f639dbefde0caf91
SHA512 38704fb2acd805c39dd131fe48e20fdd1c826410c0a07fdc1877700ec895576b622f5d0a9fba699b4e37f05b4d9c9b47a528983be9e25d75c83205347938bffe
SSDEEP 24576:sAhGLJIFoiwtA5l7S53ygXe4i7ojhsP5Lgrk1TWb4AN5:sAMyFoiq51e30jaNf1TWbdz
TLSH
T1C2359E81EBF955D4F5B3AAB899B68571EA76BCA55E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c673c146b9e5aacc09a04fbaf4b1faa3277e034d1736522a82d62bbee089f7f1
MD5 07f20f788152a67f62858259666e9008
SHA1 d3ad97c3677b28ffe51433941eb04f1bcaf9fc08
SHA512 f7b89ea2996615b0c348d8f2013a70527624033133560c9e9465324d95409764689250b632daf1890f50af4d689ea2a5747fcf89d01bd3ab56eb0d244f72d16e
SSDEEP 12288:gmw5HEjsChNCBFgl0WDm+CB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:9wubOW9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10285E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 844fe313b95dda6d72993528a8247ab7086ae4c27cfd912f23bf84ce38dfa98d
MD5 4c529456f93ad8dfffebc43c0644d7a3
SHA1 fcd224911bad5a3f1ed502224e8913180f1dd00c
SHA512 35aeb5fedb2a868f91f9cdebfb6dd666cfad976adefacd666a927aef78217d6cfa32e229cd52f6ca238af955140a06295dc1a7459def6972c6a176ecc6041a62
SSDEEP 12288:GCZ1IyI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:zZuIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15A75129637E420F9E2978278D4F68741E7B23892233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 49369364223f3195f7bc0a5b0527fb5ed4d34173d00755c6aa29a879a32d73e9
MD5 907f397b91445b8b9c6cb8b714f6d64b
SHA1 6a4466d36bb4a6db2fa849b72acc2f7b451077ad
SHA512 cf4e8cc8c1abce85d57f38740df24992b9276c7380a065ec28715452c76082d82c771edad926f7dbd04fe755a65aa70a7f4a5d55955b2cccf7b70a0e2dd6fe19
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:0QRQyi36YOcPQLvw2gAf+PN32U023W
TLSH
T1AC667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e054e187b839b98194d30d282f1b5c9fb6e29941e5ab44392599de0a597d6ec3
MD5 d720a3f31da6f6651c5a83717aa23433
SHA1 642a90ba489be134eeb640d267494a35dffa2c6b
SHA512 73332d5c11df11ec37cfc93be97651940eb24a957fe416e027883d96854a42fdd77e36370a80f69ed71f99cd49eb8dcded878ae99c724f1a1d8f59e6eebb32c4
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:GQRQyi36YOcPQLvw2gAf+PN32U023W
TLSH
T13C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2645f764a0301cf26dac83c74c2db3c08a4eb25cb5fba96a1cbbc216d647dd40
MD5 568e3b77d22d00595bdaa4554130cb13
SHA1 b1baf713e7a0d32bed5a3ec097fd793ef57969a6
SHA512 15d82ee30ee92b2eafe0dd3b9b9617b1f386af257d3efb40102cd2d6d2bc0212f36151099b5ea954ebf3ca637a687793bb2b6a9d68c947c3370cba292c79fb2c
SSDEEP 49152:z68Qg55nhheWu7PNU3/0e30jaNf1TWbdz:tthWRc/0U023W
TLSH
T146B55933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c432817f4d6749276f5b6b3a50f0f7fd81257cba93b46668f2b45c835c595a0f
MD5 8fdb0a5f21883c2841769210eafbf206
SHA1 b52b5e14f1d33656ced484cbf9a77440507c443a
SHA512 c18b9a6a39e8f2f3709eb9191cf31bfc9546272fbb6ae8ce01777c49a817fc1fcdc826b93d19a7a99112b82b79791b4f4102e9699a88ae4a9bcf29f97b0800b8
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99o:uy5112gYy5azzVvL69nLKnhZTU023W
TLSH
T1DE168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a1646345c63c171efec0cad815a1f213e03634520bf5b4e7443e73e0ebe5d88e
MD5 5f34099b154e4043a594b94cfc51cfab
SHA1 79d29adbb8d6fbeb4a18e914afad4c5ab8f28bd8
SHA512 7c825b52f6c636f5e067a288c8733d17fc568a7949675db526af3332ea01343f834c21325943edd33ca70dd78ed0581f18dd82108bd83d9605c541ab9154d8ae
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJe30jaNf1TWbdz:Ju6JmVxd2dJU023W
TLSH
T1DED59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d11c983c5f9126c321ecb06d6431e595b18455585c00e3f533fadb97f56638f1
MD5 39072041e89f6426e97aac18c67dfbfd
SHA1 38d4186b7c9cfd7043e6d60cc2bc80a4d41dc0c1
SHA512 c33dcd0f39082534014db4b340fa1e58d932c47b7ceacf80f3e133702078434c41c541f573d95799d62b0089ac513ada0d27c80094e7033947bdfbcf637e4d5f
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4xie30jaNf1TWbdz:fmifPbRFU023W
TLSH
T141B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 086865cb67ce3f936ebf85a75f9c94c7be6850e2b10947e9737144745700708c
MD5 0806ff5a50ded7e9874f105658c31016
SHA1 8ce2d19c4dc9e6845975d4777de54b3d636543ad
SHA512 cfbe9f4f4ef474d27867a14b064d6ea260f0aae2d106568f56f800db8a8f64a8e86ba1a476c812f9674622786829d77b7161da6d7d261e75b400d6adaacd2b15
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHq/e30jaNf1TWbdz:S5dKTi61/U023W
TLSH
T1DFC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dc757922a50b641fa2fab88e6287ecf6703a6f53469295357e1e4dab74343d6d
MD5 3cde0d0d8add3954e4386aba8fc4dbdf
SHA1 2887f1c44da21e905b42c40620a35d743337fe1e
SHA512 66505c6a82f984d6b3c84ce2eaa4928a9fa676483a554528d19081cae1ae831200bace5f8a3ca71fd55380d15d67f6d0b104ff165f26bf3d50ee2f9f2a51e00a
SSDEEP 49152:fhtSn8EApI0figngiDn0AP5wue30jaNf1TWbdz:OX2iyphJU023W
TLSH
T19395BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 c78710578f9e84a1f804f437a05e98573798346a287128f4fcf729f826bbbc8e
MD5 c580aa8653e8601ecdf446a42c419a81
SHA1 87ba11eb9ba9eb16b3d73c71b69a7f906e5f2bf5
SHA512 2787713830449f9377659710e6ac015acc60b591c87c1f71f7d59368cdfd01e13971f7fddbf8ebb352dd610f8049375b0ee8d70ebe4362da9ca890889785500f
SSDEEP 12288:5H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5UgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F37523919E550ACAE34BC3F0D0F787C1E9E11FC672404E6B57E0B9531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 c42b829a4d11fc9f2d40fc9d43a2737f089a8415604d1a42f30ad00a1f2f3882
MD5 c165ee5d4c10640c1d1c10fcd92c5f87
SHA1 dea817bca7cd2e4bfb8cc8e49ca67e0464a20551
SHA512 73fa1213e96014cae8df07135966b4fa04198e5ae1bc60ce603c175fa78434871041ae3d0c27488585d35562795109cc2679d27fb3774f40d57daa3c75de32d3
SSDEEP 12288:oE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1647523A1AE5509C6E34BC3F0D0F787D1E9E01FC672404E6B57E0F9531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 cdee7a9af10b9789449e8e860e9b4c2b1fb49a38e036037856e4ec3d8f19b985
MD5 f8bfe8a87a908c1c8a77efdae8afa8b9
SHA1 46e6a130a6f21e6a864c500958a2f4c9d1c17785
SHA512 b9c5418df01c5e0b232fb7c21d0a3b742c97f36e0c165386ed46a501fb2f59346c0f903f14898246fb69c9bc31e84809d298b9ad8ae4462b3091db912b1750b2
SSDEEP 12288:Sa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:SzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AB752391AE5509CAE24FC3F0D0F787D1E9E01FC672404E6F57E0B95319BCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4026cf4d196602f2933cc94da11f8c78b94cd9ffaf1444d36b1fbd35c3681055
MD5 8880e31f38a80bc6a4a1d6dc9f6d58e9
SHA1 7e382629d3fb74b7572c2566613f26eb363365dd
SHA512 6c21235b7349e20e99e0bd468c4b1ad2a469cc96ca6f8b73d6a702c67fac78c11e6748833164bd01d30335e2e5d27e534481869fb089cd0e196786fb50cfc11d
SSDEEP 12288:6Vl0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A77523526F9905C6E18BC3F4C0F38791E6F13DC173118BAF47D069530EB8AD96EA4A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 055c78f6e32909694f3b8578e392aaff2eff84d9c13023beac3d4d3380c04787
MD5 21fa9be250d416ea83d3a2a6d2457e7a
SHA1 1bcfd1d94ae1a27fb5c0f130df0e409baaeeed99
SHA512 1783216839b36bfa3a4593cfff0456c4f0aa9e3ea5459f7fb96050886b3ddfdda7a63fbbbd641a1d6c342affca44398c59360e350e707cea9df20ab66cc8e9e1
SSDEEP 12288:Ot0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:O6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AA752391AE5509CAE24FC3F0D0F787D1E9E01FC672404E6F57E0B95319BCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 6a24cbd0cc9c85efa4ac0288fdf178f8f59b6d287efcacb05f24abb881866b50
MD5 30ed2d2c1ea6fe20e67c216ab16fc986
SHA1 7ddc57a67c5daf25d0c0e36ce26981914e8ae270
SHA512 8265621a95dd4066f27c8e3c3e6029eff4af1929833f95de34d67cd8df988f0e16bee23e1ad79616c2de2a3a569908623ba07e347c8063535e99f9f6c4a43abc
SSDEEP 12288:ew0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:eRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13A752391AE5509CAE34FC3F0D0F787D1E9A01FC672404E6F57E0B9531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 9dca5bd78e8a06b0939c4e0325026e2e315e420a5bbc40581ac4730e96ffd470
MD5 2b70dd6c3b713d42aed05724ea0680b2
SHA1 597b9fe328c32556abc8f28cea3e294716a12162
SHA512 9bcbd32851b24f0d8dad0e9e4c2c331afdde4d907ff0bb536c435e6690bc8d203919f9e176b355a653d257f63fce4972fa8d7978f9ebea2db08f38567abf2ee8
SSDEEP 12288:pM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ptgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C27523A19E5509CAE34FC3F0D0E7C7D1E9E01FC672444E6B57E0F9531ABCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 4c314fa22a280823137753d6e87e10795f625825b1eb22b0417e9173d2711f0b
MD5 765ecb25bc12affc7dcd432ac05ef70f
SHA1 e6204a96207c1e9210c76620a33497520166044e
SHA512 fdf78b874fb8644e33e368c2d366792dadd062b46b8b5cb1a38e7f8ec00968ac529c0a21be2117864818b4c39331a929f04f6861d58fe19e6c9949f2d0975ffc
SSDEEP 24576:tZMzzFVSOlgXe4i7ojhsP5Lgrk1TWb4AN5:tZMzzfce30jaNf1TWbdz
TLSH
T1FD850195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03E436671F773A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 293d273c33084ad86968737edd620083bed37787fadae7323749a8743968da33
MD5 d93f8770d6424e8a08696e293d04584c
SHA1 58d811492ae152220c26c3fade5b091d35d7069b
SHA512 8721b07ab879262b679e138593eddee2c4cc4512a559a4bf8a3d90532f98e82e9716e58bbb43c69b940e736fe08d09144df75e1b95f1a408f7a934f27d3a0be1
SSDEEP 12288:Pb0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EE752391AE5509CAE34FC3F4D0F787C1E9E01FC672404E6B57E0B9531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 e45559f0bfb5ba838c753d774c02d8d5bfe4f9b79bb014bb927785ea60fe44bb
MD5 2a45eaf6e1ab88fddf9c1859a6584ff1
SHA1 08fa2ea1f3549a1792f83ebba0e83640aaf74f6a
SHA512 c0074926ed78d2d6c65d3116cb214c45c54ae23230253defcd759080f0dcabca8153a8f03078421817bb90e3f70086a4c383b09aa8249c318506d50b7c93d7b6
SSDEEP 12288:Xf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T186752392AE5509C6E34BC3F4D0E787D1E9E01FC672404E6B57E0F9531ABCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 aa2cef4e7d7b21e35a4ed653a4256fc4ee2516528103efb3d26499de0455862b
MD5 b86a23259b160f1dd2f2575fcd1c05a0
SHA1 f32f512475c337d7bb4d4a1bf1e9f737c42d6ab3
SHA512 f3dc7f2bb5f79b029515bb7231915475b6c7a21338a2b5d4169d5d002be0cbc684812dd677188c36b67fe5987e55b93f7eb2f1f4f597c3db7afe9e14c5456e9a
SSDEEP 12288:qyPz5L8I0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3zypgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10085025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 e3b911768a3c31e8fe1aefd80ac854386704dc92aaa53ddc0683c03a837da4cd
MD5 157d73b683b52e06a661d2e5cc8a224c
SHA1 bccff75be3664344d00a0d392ea290f950c13c84
SHA512 5773a04c47cc6ad6640d2bef7fe4f1ca0fe8a522860cbfe8f529c2e6cf4b6ec097e4a37fc8afc78a8c3e072a25eb07b7a0b96215c3cf413c36e5a8c058188fae
SSDEEP 12288:fb0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13B752392AE5509CAE34FC3F4D0F787D1E9E01FC672404E6B57E0B95319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 408030ff609acd1e6330bb20b2ded3bd4c2bfac69bdd8c1c39f8b85b11452000
MD5 59487f94f62028122fe2db28b3b0860e
SHA1 f4c53bb0f8bb132f8bce8c15614e2b62bb35f235
SHA512 b860d6e93e25dd4ceec25ad65ec294fd1c896e1211b3e5bcd78d34bad97e7f1c9708cc760b596153feebc6192cb20ffcc2f75ac42cf07352eb78146a678cbadc
SSDEEP 12288:lb0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T122752391AE5509CAE34FC3F4D0E787C1E9E01FC672404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 a823b7f4a74685124f3b4927976ad35b53b28beb4eecc1169d5d0368640a9f95
MD5 a245dd4218fb287d221dae0d3426cc6f
SHA1 219daba3b5a5fd52755b615fae31edacb3fce76e
SHA512 04692bcb0abf9be3141136f3a8d1234f0ccfbb23f53b4fd156770d94dd40f65a9074d2b06cb12dff8257f4b1e3393217eb376a61e72415f8a041259aa9354363
SSDEEP 12288:ByPz5L8I0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:QzypgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15F85025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 50eee1c1715391e72a2e3703c049187d5f7cd61fd6bb9c2d426722b2778fb3fa
MD5 dafe1f3f011f6f01ff77dff821598e4d
SHA1 6d021896ef4e66f57f7b2fc8ebfd364958f6bd70
SHA512 94a38aa9c42162a13069b91d79f6f14341093a3ffda30b1788d7aa08c2b7c603ba40f6f3e8bb03b70280f6f0f26fb107840280dd092f0206d8d99e194c68977e
SSDEEP 24576:PToaLl3z0zDjgXe4i7ojhsP5Lgrk1TWb4AN5:PTfLljBe30jaNf1TWbdz
TLSH
T1F98502A5B3500CF8ED67827EC8A68A42D6F27C560760CA1F03E436675F373A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 97bccba6c3f13ee5acea0dcb6adb98d25efb299d5eea44b98e8dbdc05df5a940
MD5 feb06aa00a7e261d90704fe1929bb5b2
SHA1 40d907db5ab3e9d921a54796b12fa4ed8e0e1474
SHA512 78721fa14c4cc5adbe668fcaedb8587bb08f900b63615cd47e66b64778e364c71a437efcfe00e3ad7e8b7b6ffc4bedba22df75c8a3fceb59d8278981dd63cc6e
SSDEEP 24576:a3cd9CHKy7GZ/gXe4i7ojhsP5Lgrk1TWb4AN5:8cd9CHKyace30jaNf1TWbdz
TLSH
T16495CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 a751c0c8f9f754b519e14f8258016c3938a87549abfe92da73682a302bccf4d4
MD5 c18ef3309c20f8fe6c427e1ce272ef88
SHA1 b706df9baec6a8903ab0773c09a55e4dfac41baf
SHA512 9a50e37e4f813be6dc1a80d3da5d1fd63b021a66b8ca8f11a63d8a48a7655625f29de1c8aadde11e47101c0f7361f01c49acf8c7b88878962f63f9b61fb0d633
SSDEEP 12288:c60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cTgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T190752391AE5509CAE34FC3F0D0F787D1E9E01EC672404D6B57E0B95319BCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 66629a012cd48eaa3dd6915ba0adb20b6e3a73ff5252641c4d406f3b3760fa84
MD5 a5d09099b6eab0e40ab13b73b33cd856
SHA1 e6bca11a8ba1f0fa952e9d74730e45e7e7d8a463
SHA512 10970554a378fd354eae40d742d71fbd04d735ff81e96d1e1bd0467920bbc09a44f7f26ce7862e127402dbc84eb1aaca4bf549626daf5318910ba5f3335016a4
SSDEEP 12288:wo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1997523A1AE5509CAE24FC3F4D0F7C7C1E9E01FC572404E6B57E0B9531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e665bb8c64280f477d1b9a496a35f4036b630ecd09b52ac76b97e0fb5b254399
MD5 89ef8d555cb65fd2c8beb9127ce64e6e
SHA1 1cef0064f578b7392df55181b499b23b76b6c28c
SHA512 9f0a22ff01af2d57e07725f73ab70366c093944ccc3d7500e61899218d9064fc5c12df151c7af6ee2582ec656a9f56c76ceccec2756f85d9a17be9e62169fe11
SSDEEP 12288:14sfr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5IgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17675F05AD29802D8C06E92B5C3968A81F3733C5193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 c25e3ec38d04f43aee90de74b7d06b672eb68255c852094876403bc90a579bdc
MD5 3b646a8e1882d4152cb417e734fee46c
SHA1 42d8be13ad007859b7e4d1a08a319b635b3c107d
SHA512 1153051f6f564e2cf2f92ddc640a47f0f6f8e3ee911ddd95717d9589e0c5a442d38e4ae3743efe785bf2573bae6e9c2f68d3c2a838eb5b2b02f55740a976f845
SSDEEP 12288:lY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13F7523629B9809C7F29FC3F090F7C7A0F5653FC06B00899F66D0B66319B8CD59EA4529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 cf4db25400a80cc9e34c6462f9f3412732c90e40419bc1949c866c925bf07f1e
MD5 b2bcdf325e1d9ccf15bbdb30893b0aba
SHA1 b143861b8e8095bc7bf32eaddcba98160865e45e
SHA512 e29aa560da3967f5db030a3a589471b123e82c0ca7b4598f99e5625da365c1d395cc0e76f9bb6288d72a2c47088fe23071a15b643d20f38549cde59b62414151
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQae30jaNf1TWbdz:Ka0hNYG4JwTU023W
TLSH
T1C185AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 d2928737e34fc0ebe667f2d2658f4c069789bf7da6cc91f7b3a17c7a9f3a96b2
MD5 b27707d22dab286e6edca057616eed48
SHA1 da1283d9eae06765dcca2583ce246cdead73e422
SHA512 19dfef6e1904efa95c8eaf2c1f131b9ebd570a665a06097b2452a07587e96f25fab0de7fc5884233950da0e9d6c4c17ca63ff108caf234e27db3f781c5d14063
SSDEEP 12288:9hbHjfX70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9hbHjP4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1647512BE2AAC10C9F276D2BC91E28642D371BC55271187EF13D1927A0F3ADE85D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ee53fddd388f5c1a411dd4e09f46ac014e64458ea070cbbd06b14319e09fae35
MD5 79bdabcc0326544d5e4fc6a068118450
SHA1 076b1376158b40fb78df30faf0c1497a51b5a6bd
SHA512 27b4c8a17e7d8688301459e8f8f59fadae6806c48eeb75f08e41b46a74057c93c2835f46eb3929ee4cb4f859fd6d99fcf77da85897b2bbf412ba7c10042884bb
SSDEEP 24576:t3YgnJcRTk4yti+R5dBR/ggXe4i7ojhsP5Lgrk1TWb4AN5:tIgnaTk46pBR/ne30jaNf1TWbdz
TLSH
T1F545BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 a27ff4d321d1e7876d4aba629005761e73b77e8fe02c526766ba04d5c8f852b5
MD5 5c50d75aca5b8e97908e9a657be932da
SHA1 48825099d5031edf08020c3c4d10a1877852e867
SHA512 7a52deb80b97e85cbf1888252db76d82aa4a9e742bf951de53b035abff95480939e14d10e256263c8c8c20f93f9e51b7f2f8412fda6cc2401d773db9419c932b
SSDEEP 12288:o00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DF7523959E550DCAE24BC3F490E7C791E5A02FC133014EEB56E0F9631ABCCDA6EB4468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ed8903f95328732394b709188e615cc1fbeeb82086075eef7f62182b856110f1
MD5 8d231c0b55bb2283e525897ea8d7e004
SHA1 2c38bf9092210d0131a4ea199c08c3a7cc5e4049
SHA512 0bceff93fde097fc905436abf56c81373f64f8cbb4f18e48490ff7c946c813c8b6b3bf8b4228340a8b6cd6b44a85a8d72ca65a4a4cdb33b188f5fc5f2587ece1
SSDEEP 12288:7ObsA4LWOsvAYFTl0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:EsL3UTSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17695F155F79400F9E96BC27CC4A28A12E2B2789D1364E7DF03A84B661F637E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 5db28dadda3ec12eee61bed6193053b64ca056ea039daae89c1757698b92fbc2
MD5 cb280b057bfce406bb0e0942cb58d629
SHA1 963fb0131b80186676c6b5cc4cedd7bb265d3276
SHA512 0b9a4618929f404172799e140eab75ec6850efa4e985cd4b0497215c80948cd77c0729bc11e5fdf3f9a0826db1c08c7dde8bb5ce936d1cf755bc1ccf90f2ded5
SSDEEP 12288:cpFt+OB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hOugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19C75026A37EC10D5E16AD27C85D38349E3B17892171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 08353a891cfa08e0f8c9a6160782f08ef60976f184e730f454f10b8ebdf3589d
MD5 544a24919c9c8b38cb68f4aafb26b09b
SHA1 38ac4149d701a21093aacc3d06c7bd73376e8bb6
SHA512 d699fb198d14982534b12b566e11dea93a98913d669acf41655caf9ea78b23d241648e4ac177271c09c110dc31c11df84a9a6200a55d54817969da45706c32ed
SSDEEP 24576:j7NM9YqZqmWMUkPjZM48Mv6bEhsJgXe4i7ojhsP5Lgrk1TWb4AN5:j7cBWMpPjN8DbEh/e30jaNf1TWbdz
TLSH
T127659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e1ab2df04847bd1b498fa972f0ef0a02d1486876155f1d610ac5636918b88098
MD5 f147f6f288ef8d7b93f48ee87dab8ee5
SHA1 31493157b0ed3d9829640d76312c94f003892b32
SHA512 540e17de928a03d9f60b6cdfbbbb6ae1e6a1803b71ff7fe18bd17453ba076a3019f008642542999e20d26a3419f07fd710844f5c8ed857aefb6226445d1e45a5
SSDEEP 49152:8F2YuHNETovAvNYf8kmUe30jaNf1TWbdz:Z6BCf8khU023W
TLSH
T1E5857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a321154bb4c26b7013d45130291d385aeec98335df6506bbb8e148cc373e4aa0
MD5 dfc19cb4127d9a0e0b0bd8f8e7f02343
SHA1 c437ccbff1623f1387d73eb0177e1a80da3e125c
SHA512 1dab1c02a8874175270e307ebe601d935826f007e1ad00532ab4ba5c942ac1bbf9e681c87d91e4edd9d73f9984b2f4cfd0772b458f3ea54cff70f64090bfcf08
SSDEEP 24576:nAFs06+Omlf3NXEbTo6gXe4i7ojhsP5Lgrk1TWb4AN5:AFs060lVXu6e30jaNf1TWbdz
TLSH
T1C365BE2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 7fc4fcb2f5e2577583196b3ce570f382af6e7611086c3e0bbfc13eb5971a064f
MD5 ca8d9e06b0fedb4c6cda0dcfd544543a
SHA1 2d97533f4d42a446fb0ff82a245d3c47119fc13f
SHA512 6b486d39a7027b9b2affc42a69f54cb66b6cdfd5855c7278cd332fd1f45ca4f8413844e59e90a287c67bc6283259563f907b77814447ed19ac8a82b53be3c422
SSDEEP 24576:eJnJ5D3W+DgXe4i7ojhsP5Lgrk1TWb4AN5:eJnJ5DG+6e30jaNf1TWbdz
TLSH
T1DB95D02DD2A810E8D0B7C3B4819A5795FE72386D2F226ECB14B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f2af6b865c40d387ded9fb6891fff1fdc822805e4b882df8b78e7dd5ac9b7d3e
MD5 8bde2e15052e1d574299274f73e2af38
SHA1 e82c944de347e280317e9d0664ca1e6d8a276f83
SHA512 f7fcb574160e14e55d6072503b592e469aa8cc748a30d56c56a47a3bbff26c7c426b28a2d354e403ebc949558455f49d6b6074098cbbca4c5d5fdb5ca97ce23c
SSDEEP 49152:Xg06DIKdwc+eQnSt65aVYe30jaNf1TWbdz:QeU023W
TLSH
T1AD955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 86a9a0f9aed2742de904d9bae4edb8da8ad816ff8c2f5fbc2d157e2d233606ff
MD5 7665bf27aebc654c9021999803b7a5a4
SHA1 548a6eceead65cb7d06c0c02ab738206f53ab95e
SHA512 136d60eb62568c20f755245d2cb355b41fcf90ab5856e8cd1a8cb6ac18b96ce4dfa0574908221ef6a7b671399338b871331407a4e76cff07e705160dfc5209c7
SSDEEP 12288:uEP3RWK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NWDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11C75126D6B9C60D9D12BD17C90E28741D3B2F4A127421BEF02E0D27E4E779E92E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 33c987a3ed418ddd8171eb815ed6906b511b57b0dd97008cbfdee644b606d1ad
MD5 eb22a43cef0b9d75eafbd6531cc29c6a
SHA1 e80503f5822d83fa9142e7a670c23675dd027f0e
SHA512 9a279ea3f3a4699825b4aff56015dd1ba9359014bfef87d2ef69d9382106a9809a1533255f7aca69e0b421b6f52b9b05750783c6783759f50c603c17fdd4f469
SSDEEP 12288:Kjky70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KIy4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B2751204679814C5E2AB8278D5F38390DA70BC606B108BEF51D0FA3F6F7AAD4AD74B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 2276996b540491f6f438ed1420017556c2e760f1e83f30005192805c6ca61eb8
MD5 c76d2feab5d44d5dca7b0c1ffe4ba556
SHA1 8ca9847b93d006b22bd2c49effbebbeabaa47d36
SHA512 d18078f034f063ab40f356377119bca995f4fd828fb38d2aab54523e4ef582b9f69734a367aed29cebc2c821b15d13bce39a7e35a751bdfa95923cea61311e1b
SSDEEP 12288:Ogx0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:N+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1477523995A5519CAE24BC3F490F78B91E5B03ED133004DFF12E0F6735EB88DA6AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a78711754ac75a7e2a7137ae8bc854e199116fff0b1571e892c82be898781293
MD5 f609bd9228b6c336ffe1eb285ad63056
SHA1 8352c7059ab420a04adfcfa93617bf86eacba450
SHA512 1335d4c7ceaea2161390c076fb578648a32be0411c1c1d2a5e7fdfe49e9fc4b608dfc44de57a8a774115892c41b081600939172673c032a9002a68cedc98d88b
SSDEEP 24576:nQ9MxZKdcz9dw3RgXe4i7ojhsP5Lgrk1TWb4AN5:nVKZse30jaNf1TWbdz
TLSH
T19B557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 7088ce8c7f587a8e9559cc42320786dacef18de470c0228aa3960dd5bf8e9fb4
MD5 8e9af289e4c23a4eb9a62abe3d9a76e5
SHA1 b03e45a682743b7e007500ec09ed7843392c8b96
SHA512 7e86a300e71159341528c03841655e4392323879633dffd687fa35535ce336f6acccf8b7dd491c3f0e05a202902ad4e42501fd959b3a3c407befbe2a1bc97c92
SSDEEP 24576:gyoc+ApEgXe4i7ojhsP5Lgrk1TWb4AN5:toc+Apre30jaNf1TWbdz
TLSH
T19D85E01FBB6900E2E166C23C88868741E7B3B4702B5257DB56D1C33E4E679E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 416863663c011b6b10a74382fc12cbf0f0d3c34ae2b3bbdcf9d8c60151d8eeb2
MD5 0dbe6e4c1dd1dd2191dabb53715feef3
SHA1 836e7ba4f4c85945b7dd92f37758d4e0a9c5e4a5
SHA512 6896138dfea270896e317f163886deb5a4ce2b8d58aeef59347f42f6276e15e7bcbf7e32bfbd27338f2e9cffda857eb4325142ba7aeb20dc2f63bcd252433106
SSDEEP 49152:UWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKre30jaNf1TWbdz:+0zuNIFU023W
TLSH
T105A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6806cbef99c5a0b40ea684d8d0643c226375de26e72cae69268720d47806ae38
MD5 ffa1deb270a3a1e136f37a1b218f9e97
SHA1 7c0f2c0083ae4cd97ab4df84cd4e457aa64cd577
SHA512 05c4c2952096db991179137435b2a6c15a71c4d3643dd447c7a213657e0a531d1b5d487d7a2fee8f093e4537a8ea0ad8e07aa90495fcfa7d1c5380cd57483940
SSDEEP 24576:P1QT7EcpfxR+N5AWAz3ooiYtjMqbDgXe4i7ojhsP5Lgrk1TWb4AN5:yTDxR+N5YzTfjM1e30jaNf1TWbdz
TLSH
T17055B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-84-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/436-237-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/436-75-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/436-81-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/700-465-0x0000000140000000-0x00000001401B3000-memory.dmp

Download

memory/700-326-0x0000000140000000-0x00000001401B3000-memory.dmp

Download

memory/1124-250-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1124-317-0x0000000140000000-0x0000000140198000-memory.dmp

Download

memory/1124-249-0x0000000140000000-0x0000000140198000-memory.dmp

Download

memory/1124-256-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1172-406-0x000000000C330000-0x000000000C338000-memory.dmp

Download

memory/1172-385-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1172-466-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1172-401-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1172-369-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1172-331-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1388-235-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1388-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1388-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1388-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1820-461-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1820-318-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1868-70-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/1868-83-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/1868-66-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1868-73-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1868-60-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2208-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/2208-8-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/2208-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/2208-48-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/2288-410-0x0000000140000000-0x00000001401CF000-memory.dmp

Download

memory/2288-307-0x0000000140000000-0x00000001401CF000-memory.dmp

Download

memory/2300-427-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2300-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2592-428-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2592-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2592-330-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2688-229-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2688-13-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3080-280-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/3080-403-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/3396-325-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/3396-273-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/3604-313-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3604-245-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3772-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3772-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3828-303-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3828-409-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/3828-295-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/3828-296-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4012-408-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4012-284-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4012-290-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4012-283-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4188-322-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4188-464-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4232-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4232-34-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4232-40-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4232-236-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4308-25-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4308-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4308-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4392-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4392-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4896-263-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/4896-321-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/4896-269-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/4896-264-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/5088-437-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-439-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-425-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-424-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-423-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-422-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-421-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-420-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-419-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-418-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-413-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-412-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-429-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-430-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-431-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-433-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-434-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-432-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-435-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-414-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-426-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-441-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-440-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-444-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-443-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-442-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-438-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-436-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-445-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-446-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-447-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-449-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-450-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-448-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-451-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-453-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-452-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-411-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-417-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-416-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download

memory/5088-415-0x000001B588EC0000-0x000001B588ED0000-memory.dmp

Download