68a914a2bb35aa0dc491fccf1a4bd166d48d76aea8df6c8d8c97cf9cd1d0468a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260709-rs4ehsbz8r
SHA256 68a914a2bb35aa0dc491fccf1a4bd166d48d76aea8df6c8d8c97cf9cd1d0468a
MD5 d5d9577385aa22df0253b7076f7958d5
SHA1 2454942ddfcd3c24618b7d1ed72e6b9959ede3c8
SHA512 088f6e80e0420fc98e59d9ac3013124f0044c2143e11b6e3379bdbb0f9c0ca4178c2cab6b1f2ae8da2122c07879276212174d4935f7d2188fead4bca028ee163
SSDEEP 49152:1UwAhazupak4uxg3gOfAnYLcQoVH5TLRi+Wr+8RGtsxcf8yphzhjuTGiGebcFvVM:oCUs4KjbAvVa3w6QA0dMJz6
TLSH
T1EB267B0BE6B940F5C0BAD1798A57951BFAB27859873297CB4790474A4F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
3584	alg.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2972	elevation_service.exe
4988	fxssvc.exe
1708	elevation_service.exe
5060	maintenanceservice.exe
1768	OSE.EXE
3856	msdtc.exe
1772	PerceptionSimulationService.exe
2360	perfhost.exe
4996	locator.exe
3296	SensorDataService.exe
4604	snmptrap.exe
4620	spectrum.exe
2616	ssh-agent.exe
4552	TieringEngineService.exe
3816	AgentService.exe
3656	vds.exe
4968	vssvc.exe
2064	wbengine.exe
872	WmiApSrv.exe
2200	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\67bdc5427c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008babd171af0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a4e7271af0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d1cbd70af0fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6cbcd70af0fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c137771af0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fa90f72af0fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dd01672af0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017521571af0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2972	elevation_service.exe
2972	elevation_service.exe
2972	elevation_service.exe
2972	elevation_service.exe
2972	elevation_service.exe
2972	elevation_service.exe
2972	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3188	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAuditPrivilege	4988	fxssvc.exe
Token: SeDebugPrivilege	2192	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2972	elevation_service.exe
Token: SeRestorePrivilege	4552	TieringEngineService.exe
Token: SeManageVolumePrivilege	4552	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3816	AgentService.exe
Token: SeBackupPrivilege	4968	vssvc.exe
Token: SeRestorePrivilege	4968	vssvc.exe
Token: SeAuditPrivilege	4968	vssvc.exe
Token: SeBackupPrivilege	2064	wbengine.exe
Token: SeRestorePrivilege	2064	wbengine.exe
Token: SeSecurityPrivilege	2064	wbengine.exe
Token: 33	2200	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2200	SearchIndexer.exe
Token: SeDebugPrivilege	2972	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 2500	3188	2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	86
PID 2200 wrote to memory of 3888	2200	SearchIndexer.exe	129
PID 2200 wrote to memory of 4212	2200	SearchIndexer.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_d5d9577385aa22df0253b7076f7958d5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3188" "1252" "1156" "1256" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:2500

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3584

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1708

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5060

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3296

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2056

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:872

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3888
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 afe32c67560236738c5df28d972aa4d9b5415e1c93bedcccb3bbbb3ad0193d6a
MD5 89d6c35e0fed7a5fda63aa24416c639c
SHA1 eea9e8417e725829379291086f9e1b09322b509c
SHA512 5c53b171a24efe995de44b67bacd110cee8d0c72b353226284bb80511b3d8b076f52261d3f68a56e8fd3086fe2d2556e5f4af596c04f7cfd6715418395e684d7
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRebcFvVa4eZw6QAhukeMJz66:A3q6sjB1bAvVa3w6QA0dMJz6
TLSH
T11BD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ef7c04f43fc58d8b0f2a863899caaf78b8972cc60a31449bb5a256b86da876bc
MD5 3c65453313dad357a028607e5329323d
SHA1 8e5e844a23f4ffb35022d9c6019d58d365c64429
SHA512 20b59f14a7108e01e98c51b5681b83c8fab8b3d8b2c359fafebcaf837e4ad56600a3b51d5a51cad15847c289b9b97409148a3ec43155b07c16cd241c25ecddc3
SSDEEP 24576:UXYfDtczAMebc46vVa4eZwq86QAhhUkXuMDtz6Blg:TtczebcFvVa4eZw6QAhukeMJz66
TLSH
T1AE75012873A40CF9ECA74279C9A1C411EA73BC954360E7DB03E4A9695F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 85e49fd34172739ce7f9b13d4398fe538fad0486be1e20ac5672d23547a9277a
MD5 37f36ee66980a183a1497352572c065d
SHA1 77e06e09f21dd5be96cd80d7720b51e917e4f1f9
SHA512 da22ef7e6413e1161bd5c009846400ae004b8807cdbe714ee056890d9e2c26979b90655418f7294a9559054f14a6c52ce9d661f6ef3d415944dd7ba849c89333
SSDEEP 24576:70Le5ji0hmxxrMJebc46vVa4eZwq86QAhhUkXuMDtz6Blg:7Pji0AjaebcFvVa4eZw6QAhukeMJz66
TLSH
T1C8859E16F6748735D073C0B9C5D2A68EE972308257308ACB4286D77C7F67AE68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ad37a4c5f3c64f3b20ca0e8bf2886a4d4ff60153c82c012d7fd21bffe5b886f2
MD5 ff4142814f1834164ebd492808fe8bb1
SHA1 77be7350700212e43aef31ac1646ff7e515437ab
SHA512 97701bb6c8ca140ca9b56f1655ab5095485f9a3f219e5d6dbd5e7e7fd6eb13f8f2a28562fd171f8a86296fdf43715787c99b180828058590e36f8f54d98bf55a
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWn6q8wyujebc46vVa4eZwq86QAhhUkXuMDtz6Blg:s/ezSC6vUzPveHjymebcFvVa4eZw6QA9
TLSH
T1D4756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 be7e1ab667080d1b97cb27a36047caa062ec28e5ce18a3d0d3a7f53f8c2dd934
MD5 e7ae1f8aaf9b1d841813388026853d52
SHA1 a0963dc6e3e5ab6871c584b6b35ae23822ad89a8
SHA512 b65e05a3a1e94b55af23f7a6f3ac7e6efcf24bb056bb05285685dc98e77b58d6c3dd05847e77295198adff0ececfdfbec336395d7b7cce6b427edc5cdcf6d040
SSDEEP 24576:uVbqPb88hv/l+YQebc46vVa4eZwq86QAhhUkXuMDtz6Blg:uVO88hXl+rebcFvVa4eZw6QAhukeMJzJ
TLSH
T1F055AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E776E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7c38c735fa5c96fc4041fad366b4fb8c3f15ba410c44d6f5f8c7a96c16a06852
MD5 b557750648e05c670a5905541a273ae6
SHA1 d3e60d3351b6b0f1be22fa386eedf5bd0c3ad1ac
SHA512 1205b77d21a0703a04e9f5ec391d7f97accea97d64405000a26cddb4520db8afb7aa61321071fb1551a24020da9ca7cc21a5326514ccb95a03dbbf62db4b98c8
SSDEEP 24576:oLtebc46vVa4eZwq86QAhhUkXuMDtz6Blg:yebcFvVa4eZw6QAhukeMJz66
TLSH
T18455231584190DAAFFE201F2F6DCF89589949C94B14B256E32A6BD9D9DFC0F8CC8121E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 06a567abe0f21a812dd2e08ffab5463a6e96b42897aa2ed84d195fcdea4dd528
MD5 f76d680fa90164dce18c44d35d2a6287
SHA1 6edc0fd29ca8df85421f2fa990072473a05d27cd
SHA512 6848d647205746df34c86d468d8428b4074d4b4c4f85cd59a6c3d5b10756b70ad1220c92d495abb906669779b9dd10b2821747bcc5257d7da296c01c895d7d19
SSDEEP 24576:eJIUIebc46vVa4eZwq86QAhhUkXuMDtz6Blg:eJIUIebcFvVa4eZw6QAhukeMJz66
TLSH
T1CB75CF3BEE28FCE2C67A4DB95A91C600D77278704B62A3CBE175820EDE235E05D75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 855d30e7e5162c0be0a17fa505cf65413917a6a7e5e7ed8dd57f397df56d664a
MD5 8e5670c3cf87ef0c29d555f171bc5054
SHA1 120c53723c9f286fcb8e3b7d89654e8ffce51b48
SHA512 f7f3bb403ad3572c2b847ab9c8e9c00a245d2098fb6c50f19fe59d0414c7ca0ab0c881c2646fe205eae834709f98f5bab8710d3bde96fe1b96f4120eb5fff689
SSDEEP 98304:dQvGAdlCEL8c/DRNw5CKbAvVa3w6QA0dMJz6:avyEYc/D3w81Na3wpXdCz
TLSH
T111267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9571755052113acb792b50ed1e0915d251e9d9a6d77a5cc0310bbdc91c47fa74
MD5 9e7866a868d134cb5482cb14a42c09a5
SHA1 508d13d20a39d94616be84652b0de78be33d401d
SHA512 30bfc39699e6b62d000a6159ae174eb481dbbc1279d53a15652bf014fc915e04e2d5ddccf922fccd43b8c466611bfbcd68b3dfeb6b57ba6dcbac1ba24f9d34ba
SSDEEP 24576:v0ewsAjKebc46vVa4eZwq86QAhhUkXuMDtz6Blg:sljKebcFvVa4eZw6QAhukeMJz66
TLSH
T1B775F031FE34E436D7BB0DB22B25D706183CB9204B522AC3E3E89D9D59741D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 569b89ce501eb6f62da6c321d048ca3df1c5fa5b71acdd4bf4492f91f15669eb
MD5 e17fd910f4ade74946ac19772c858e3a
SHA1 db993fc7eaa96ca768190f38349ef46257a01fca
SHA512 b3eb3c176e81a1db1cea8d1c226d353d8b377c97eb7363f24b5e122476fcd9afad401ab6633f1e00ea67673f5f876fdc321967c937b7f72145407ba5adb8c91e
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHENa3wpXdCz:KUEtQevvqc2W1cpV2tI32+SOo
TLSH
T16C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b053403e887c8460345b97c952c84b64a93f15136321f7927868e528d5e78454
MD5 49d7e2e7c3b86e8a7310be7f608281bc
SHA1 0f11c01df8dd349a1046c33f7cf47d29b1a1bdab
SHA512 e295eda7e724e2ef180bb83d862f44dccc01ca00ff6dfc260b18b5a50f8642ac677fcc2e9d088657c3619aa5a3669653963116f57555383925e2ab80664a0a02
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/zqebcFvVa4eZw6QAhukeMJz66:uoq2Vjnm2bAvVa3w6QA0dMJz6
TLSH
T17ED58E0976B8C1E4D1F6C37896A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 92c396208ef03c444b4bdd3e892aba3ce283c029c140aa1657cd2b86edceb34f
MD5 fac4c973fbf896efbcba2ec85b2df366
SHA1 74756f3719df94cd4fedc55ed1f19c29d480fab6
SHA512 7016487f7815b40ae7923ac43f26f9c198570060d0a15d29434ef166fdbb86dad5c361de56c8d7b49bc0682cb519b24a250b960232408fea4176a0c8f1d3a4f2
SSDEEP 24576:wAhGL3IFoiwtA5l7S53/ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:wAMUFoiq5PebcFvVa4eZw6QAhukeMJzJ
TLSH
T126359D81E7F955D4F5F39AB8A9B69070EA76BCA65E31C20F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a618b30f5454e97505a41b28d0d921d8a6a186cc10e92136b890711a5f7fa544
MD5 ad0edba9212e8210b6178741b07f5b76
SHA1 471db9f282c2dc828e9add53b762a7849e72f763
SHA512 5baec7641029eec8aebbc989898d283e922262ac9c290c7d336cc6168ebfdb9f524f26da54bfaddb43ddeac61b9b7e1591e0a88a8d7eb62a4ae9f4766c3274c8
SSDEEP 24576:Pwu4OWGebc46vVa4eZwq86QAhhUkXuMDtz6Blg:PwvO7ebcFvVa4eZw6QAhukeMJz66
TLSH
T18665F14A72A80CF9F9A34239C697D436F7F2BC112625DB1F1360C65B6F37261AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e12885fcf82644c195b83b965f9240e526976c3cf74fb265607a470583c608f3
MD5 975a609bc2155a42b5ff7cac64422c9d
SHA1 6d6a7909dcaa8e11c399967c30ef84bc5c099418
SHA512 47c829ab25ac8beb5d3df71dc61dd72aefee629d7eeb7c52e56d2e03eb271a9e83770f08cbe343a3272edaabcbc47256ce6112782fdf80d7a3659549b272553d
SSDEEP 24576:3ZuBebc46vVa4eZwq86QAhhUkXuMDtz6Blg:6ebcFvVa4eZw6QAhukeMJz66
TLSH
T18755234A32A824F9F9E30279E9E4D405C7B27CA2733703CF226566A95F768E54D35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 35d55a0414e044b09e73f5e84fc74a685eff24f9f1bea1c26f23d31380645675
MD5 84d3657363bd187bb58f3555a6395551
SHA1 20ae1432a3811dba338162adeaf41ee837b6b969
SHA512 f67d787ddca79aaf519f6020ac978d6332030e75351f1aed94c128860dcfc6ba0b31bdcbbaa2ccfb4b315a26d228039a7c1b85d8356c5497f51872158969c61c
SSDEEP 98304:sQRQyi36YOcPbLvw2gAf+PN3JbAvVa3w6QA0dMJz6:zQyiKa/X+PNWNa3wpXdCz
TLSH
T163667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8ebce49f46093cb0473fb6f64faccb111b35f7499b47735dc2095ca75769d4f3
MD5 731c7457374ad1d33b92f25773d80af5
SHA1 59a4f60bb80e42e3abb1f5e889123765b486d380
SHA512 eeafaf78bff514e3493cfc5a484ca282882e0938cd596bc415c7bfb28ba2701d98ef860953a93cf86331fbe3bc2c79ef82543b5685b3512001793a380fd5197f
SSDEEP 98304:qQRQyi36YOcPbLvw2gAf+PN3JbAvVa3w6QA0dMJz6:BQyiKa/X+PNWNa3wpXdCz
TLSH
T1BB667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 445bd636f359f16858d12ecef8a5eebc89e9fc86c43d67e984e0502425053b8b
MD5 d930ab40471199e8032cf798a07d901f
SHA1 b3aa87fea9835e762b457b72d7eed95e1d351cd6
SHA512 77f15995fa8ba08ea6832f96f7a0c28445894dda5720207ce0b33cf045edf57e23b12dc1e4f1e9cc02370a0309ce88fb2267eb935eb866d96222df3b72295e18
SSDEEP 49152:968Qg55nhceWu7PNU3/aebcFvVa4eZw6QAhukeMJz66:7thLRc/nbAvVa3w6QA0dMJz6
TLSH
T134B55933B2F600A9D44DE1769F4A972196D17C718FE1E3DB8111720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 36adb55e9cea2572fd3a7499d26f65791dd2ccaa39358163c424d75831b24aea
MD5 cb68886e4ceaa157cbbf82eb6e7d554e
SHA1 f040276bf4ac3bfc5f32c2da279d7c33cb7e2f54
SHA512 6bf3765b8f950521528dc1326aa7140ce385e2bb3ec43dc10340c7bccbe067a0aa3953bbc579d41513947acf5f36d2887c24fbfcca47f81d38c6c3118803b31f
SSDEEP 98304:ny5112gYy5azzVvt69nLKnhZMbAvVa3w6QA0dMJz6:6LIHEWhpNa3wpXdCz
TLSH
T1DD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 df4d2a1f629ce9169652598902510ef108c0e7fb2f3f498561f093d6d17a0fd4
MD5 deb69ddfbfd4fe31d509174e0ce55cab
SHA1 ce9835eab1cd6f1b48dfa051ed891711ee58751e
SHA512 ab59bf07d99c3db46b5fc219db1bc45fb87b1f924c229e8093f3aa637fd04a19fac8ea0ff575942b7a9ab83aebe2dca64a51622f645e528ef70a360b0ae3fe49
SSDEEP 49152:eB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glcebcFvVa4eZw6QAhukeMJz66:Mu6Jmdxd2dhbAvVa3w6QA0dMJz6
TLSH
T1B8D59E13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8b58ad5484afc0dfdc0f13ad78835c8d2871666eb0eedaab2e76e3fbd3344d92
MD5 3a941fc74e76e3d9bb2a2587ab23ef82
SHA1 8718d1b1121dcf56b6edbc2b3717e94e8fd43ef2
SHA512 1ae1824fc2148e34f92b1bd98e0443b08036beb2ff95e2da9e804b9103f976b9c5bf84130f67f5816173ee05cc6c8e3b701d78acc061cd7da36335022b47266d
SSDEEP 49152:j1hpsNoJpF1A63U44CwH7R4xoebcFvVa4eZw6QAhukeMJz66:jmifPWR2bAvVa3w6QA0dMJz6
TLSH
T1BDB5BE13F2D901E8D06EC17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f8ef0ab8ed09dbac0b6a027cd0d5364790942bea07c5b74ca699705ae1e4e51c
MD5 0e96b5d3ce1bbe6297d4e549e16a684b
SHA1 bd0f5a500e2beffea4248f729f679177e0ff56e2
SHA512 1df9c6bd71fad7dcde01dfdad9d090ba11d13078d2629c2bcb9d01eea6a29334e8b568af94a9b286de8460b417d7fcf2095bbfecca673b2bbd62662e6e7ea32b
SSDEEP 49152:8SuZQIY0Be2KcRVtOnks6NMHqBebcFvVa4eZw6QAhukeMJz66:+5dKii61gbAvVa3w6QA0dMJz6
TLSH
T166C5BE03F2E941E8E0BED674C7669232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ce7d03e36d45a6a34d54431a47d9f522d0f421024b9948d812b5fc5678cfdcca
MD5 982628a3a480b870c12f09c5a90c723b
SHA1 e0d3a454ea8bf4774d076ba06e42fb130b9f98e6
SHA512 1936c31a03ec94891ca9b9646c3312fb6337eef24373b0b2517628fd18fdc7b6ae9f8e25913f1e2d827ad7b466d412474861b7766ece12485bb6d36c5a03844d
SSDEEP 49152:XhtSn8EApI0fig3giDn0AP5wMebcFvVa4eZw6QAhukeMJz66:GX2imphSbAvVa3w6QA0dMJz6
TLSH
T15B95BE13F2D901E8D05ED174C7468632E962BC160B39BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 717a4aae0be6f0044ae505159abf49af00caacba23e649b1515db573a57c8adf
MD5 dd1cfc499b7be4d2652dde0ca663b904
SHA1 9142eea27d21da310de4fa37ac0562c5bcdddcee
SHA512 2cb9e019c127343a619f5296aa04c0f0ce9cf32135455803f0e539e8f5964329583c51bf9373797f2025f87bd2a793f7b01724bf832552e4f2d0052b72893f3f
SSDEEP 24576:DFebc46vVa4eZwq86QAhhUkXuMDtz6Blg:xebcFvVa4eZw6QAhukeMJz66
TLSH
T1C3552319941A0E9EFDD102F2F6D8F485C998AC95B25B216E33AFB8599FFC0F80C8115D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f24876bc1b17efb9dbf50a5d19812b0a7d80a42a40e2b9aeb5d0b28988387fb7
MD5 4e1cf1c4e0f22fbb6e2d8668b3c6b4c0
SHA1 659a0152b1fbd39676c7e6c37f5e02e9b35c74ef
SHA512 caccf939aa3d52f61501fe306c01f66da388f66649cabcd31429689ad66d211f4d41a7d643bf9f230053e307476b1e3ec786926f3733346e291e87dffb184eef
SSDEEP 24576:Euebc46vVa4eZwq86QAhhUkXuMDtz6Blg:9ebcFvVa4eZw6QAhukeMJz66
TLSH
T1B6552319941A0E9AFDD102F2F6D8F485C9989C96B25B216E33AFB859DFFC0F80C8115D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3b82077043b511c1d731302d79446d91f286e89b4cfe066949ac55eddc394260
MD5 cf9a8a27330dee2e5e1640de4366443e
SHA1 f5d4aab10d7f3d7550381a99a67f1644676c5310
SHA512 2457f0b0a6fc51e6b2d41f6353dcd3c238eeaffcf5114678f2545e442a17072e45552cb3050ed87cef98a3315e37b9616ad79834c573ec7013812f8f4633388f
SSDEEP 24576:Vgebc46vVa4eZwq86QAhhUkXuMDtz6Blg:aebcFvVa4eZw6QAhukeMJz66
TLSH
T1A2552319942A0D9AFDD102F2F6D8F495C9989C96B24B216E33AFB859DFFC0F80C8115D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 db5fc7aace7446fa5d06e14c4841a8211cca20af68bff607dc20832cc7496b33
MD5 a0644bc5c10d9b5ef0a1221d2643e144
SHA1 4f174e866c8c9b852403ea156f91129e1e4de174
SHA512 ad424b6e6137b5eb2c3c0a2971a04aa1d5ff74e44aba8fc458a3f9469710d5c24197bcf606cb810560be91c0fb971e224c80734018ea9918abbf083435973f33
SSDEEP 24576:Mebc46vVa4eZwq86QAhhUkXuMDtz6Blg:MebcFvVa4eZw6QAhukeMJz66
TLSH
T17355231A652A0DDAFCE202F1E6A4E455C6F4BCD5B32722AF33523C994FB40F84C60B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 970f671c53d82c066b6ae4b9fe6f630ca74ef7757ed08e429ce0a120298731cb
MD5 abe5ce946f7bb10fa79931f26a4e0f5a
SHA1 103033bfb608e398888dc6c08e61ba444988ec26
SHA512 b9c0745900204ffd0feee076139130b746827a00ee166770427b5d1137c77dd12c9f41aa2ab680628d26b1ba24276137bfe24483e9ff367962b5633777a191d0
SSDEEP 24576:/nebc46vVa4eZwq86QAhhUkXuMDtz6Blg:/ebcFvVa4eZw6QAhukeMJz66
TLSH
T1EA552319941A0E9AFDD102F2F6D8F495C9989CD6B25B216E33AFB8599FFC0F80C8115C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c3b4bcaa7c6ef61607aedd8077bea767af6bdfe10813b32ef04f339889d4abb5
MD5 8049ec59f8046965c9f18886344f7577
SHA1 468193bf70a8a52d5895345aaba81e80f7ff1cfe
SHA512 66450218d384e6725f9357912352301bdb6bcd1e9b267f754297ec77fb71052b6d152bd93181f018d2bd443a5679d7ad515ffb75a73c9e70b3a04e8cb2d7e13a
SSDEEP 24576:diebc46vVa4eZwq86QAhhUkXuMDtz6Blg:oebcFvVa4eZw6QAhukeMJz66
TLSH
T1A9552319941A0E9AFDD102F2F6D8F495C9989C96B25B216E33AFB859DFFC0F80C8015D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c3252f611bbc6073968c5348f055bc751e80725ec9779f2137d778a93d2e1d7f
MD5 92a91fb2cb5c12f76f2ad6ffac96a1a7
SHA1 dfb0a9594ed9255ac0538e585be7f774f9f34507
SHA512 d369592b4fa65c7bdfd3d13fca5f6ea1206519cebc7cf8465c64709684895be13607736581be2152d193f01601999139c8a78641ba595eae60d6b4ed701707c1
SSDEEP 24576:pWebc46vVa4eZwq86QAhhUkXuMDtz6Blg:kebcFvVa4eZw6QAhukeMJz66
TLSH
T14C552319941A0E9AFDD102F1F6D8F499C9989C96F15B216E33AFB859AFFC0F80C4015D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f04de6ae3694ee8a36cda1e21da93e397d7d0e98a52929d4834d6c6fe7006406
MD5 8fd8bc082ceab5c124569f90377a7745
SHA1 a682db7644df330f737e9286679e0a0e9560dcd4
SHA512 ae9c310a9e397c9253de81b67af4570ef84268e56d2716f22124ab6bef542f7697be7ac051653294ad68c91ec5ea4fd90d18f8669df3dad89bc5c5db4118ffc1
SSDEEP 24576:HZMRzFVSOOebc46vVa4eZwq86QAhhUkXuMDtz6Blg:HZMRzfSebcFvVa4eZw6QAhukeMJz66
TLSH
T165750195B3500CF8ECA3427EC9559806D6B27C5A1770C61F13F8366B5F732A10C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 495fca2b8aade4130edf8adbc83f1d1ba918da32afc4c8009981ef2c76f0f4d0
MD5 9b94bb40e4c91bf92b70fc888177fe55
SHA1 a57a980b17fb54d3973fba259a77763f7077f22e
SHA512 21c0eb85279d47d031504b46b5aa0beea55a8b509da90835a58fa0daa20374a44b5d6547ac0556fef331175b4ed26619d76e59c7f1342fe29a1bb7458f5bae24
SSDEEP 24576:yxebc46vVa4eZwq86QAhhUkXuMDtz6Blg:2ebcFvVa4eZw6QAhukeMJz66
TLSH
T15E552319941A0D9AFDD102F2F6D8F495C9989CD6B15B216E33AFB859AFFC0F80C8015D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 890515b9523a648a0708a4987dacc330e8970ad998c61426231d825a0108af7d
MD5 5db71940f34dd63179d87932626387af
SHA1 0a4a2695ad524f0a2671b2ef9da468fa2502bdd3
SHA512 fc28269b743b767da75e34c8af900ba0311289cd68504ec8f4f221dd1abe9afe7924b5b68ac13575d89015f85a7458de63f6a34ef47bb2ddf63c94e892caa144
SSDEEP 24576:gdebc46vVa4eZwq86QAhhUkXuMDtz6Blg:cebcFvVa4eZw6QAhukeMJz66
TLSH
T1A9552319941A0D9AFDD102F1F6D8F499C998AC96B15B216E336FBC59AFFC0F80C8015D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 46c8d428debd698198f910dba3e0432f3f3591c8c9e92945d86a4093e13162d8
MD5 35d834299158d8892cb1011cbc990a9e
SHA1 11121b8a3df57b32b7e4ed7b839bf1d2a972e910
SHA512 bb55ba430ce1015d028acef7a835eecd76cdafd5e20705dedc3b303c84c1b4040d2ff99c5180388b1a07bdfd44f5f266301e8c3a137b7f7484317aaa3ab4863d
SSDEEP 24576:Lzy6ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:LbebcFvVa4eZw6QAhukeMJz66
TLSH
T14C65120772A530FDE5B34275C8A15902F7B1BC3253259AAF23A4567A2F771E05D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e9f0dd23a5387e00073941cf8c811127bb217779b83ff90789102ded1bc0e79b
MD5 4ffbc5aa8d09d1cd09c82089d30ec85c
SHA1 1265e0d91ed01d70f4f29464ae9e183b335961d9
SHA512 952d1ce38ff07da2eaf33e3233456c299e463f354057d26deb5a421cf48c0a65b6368269e62fd07d60e8db4e9d43cc59802f02341a75af7644b6f260e44e3189
SSDEEP 24576:Rxebc46vVa4eZwq86QAhhUkXuMDtz6Blg:jebcFvVa4eZw6QAhukeMJz66
TLSH
T194552319941A0D9AFDD102F2F6D8F495C9989C96B15B216E33AFB859DFFC0F80C8115C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7179977a83340509d5ce7d55c6e5b60cae286844cc43dcb3730fa6803e912e4b
MD5 a17a9a0b2a5c857dfe3a9043e8f7385a
SHA1 c8b48b797ba2a21bb3cb30d5d02b184c6437a729
SHA512 54bdc227807142211725274f7ce94878d48351db3d91120e0a6567955340e0438c3070aa19e553f834095b182bd79df016e3852cb19f7d259d2bafe110bf7e7d
SSDEEP 24576:ixebc46vVa4eZwq86QAhhUkXuMDtz6Blg:GebcFvVa4eZw6QAhukeMJz66
TLSH
T1AD552319941A0D9AFDD102F2F6D8F499C9989CD6B15B216E33AFB859AFFC0F80C8115C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a32e57649400766a708952bd61e52362c60187a36c67a8cca2fac4a41ca2bb87
MD5 152e6acb6e440b9ae9b6d788ae8de625
SHA1 f61dee67ed9e97c67632e8c715cf5911a425b00f
SHA512 c664883efd315e17d63e49746f7f7304c91d6554557bfdab20ba1a26a55da4ad738c337ef151a72a784ab445f73730f0c7105700f76f82d8f6df5b5cf4e0d310
SSDEEP 24576:Rzy6ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:RbebcFvVa4eZw6QAhukeMJz66
TLSH
T19B65120772A530FDF5B34275C8A15902F7B1BC3253259AAF23A4567A2F771E05D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f9a0abe535d83415a1cadaf9e8c9b6b6ffd11d9a409058f609af61afce06406a
MD5 7af9fdcd12ac0ab41cb4c321a62b55ac
SHA1 93f761716329c3962fed8d6104d57d719654b76e
SHA512 6c702b0c2de6910c2775f4b5c6750ea6871006c87dea5d648f8e73af8cf86aefe34e00c12fc00d651dc92e5710c6e04a8f0ec9a6c59cdd3a8276ccc6145ab569
SSDEEP 24576:nTDaLl3z0zDwebc46vVa4eZwq86QAhhUkXuMDtz6Blg:nTuLljjebcFvVa4eZw6QAhukeMJz66
TLSH
T1977502A5B3501CF8ECA3427EC9559806D6B27C5A0770C61F13F8366B5F732A11C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ca691c0d7d71a45b911ddaf096e4186d70598f5dbf66b5400d23ca9efaedc78a
MD5 4b2284bc6e2cc3ddfb9db0be70e96a45
SHA1 5410fe6fda144b615cf53c08dc40b7dd30876c08
SHA512 3ad0c7d5b15c7ba436e8bd0272b329cdcf9061211ac3d858b338f89ca4bf1af6a67a9727b19742738bc3f79ec0bc78076123e82565a724c4f20902567cd4f1b9
SSDEEP 49152:xvd9CHKyaSebcFvVa4eZw6QAhukeMJz66:JCq/bAvVa3w6QA0dMJz6
TLSH
T1BF85CF90F3E414E8F0B38A35C9759511DAB67C9A1B31DE8F03A8655A1F336E18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 dd6767f71b20b9b0907dfcee2126ce6bb71a4e8e212088f84987ad283c7daf1d
MD5 d2af516f2ec1c4f25165bf9f9b2376f7
SHA1 62a50dbc4b080dd83e2a1c23ebc98a82890c0be7
SHA512 46d6c133e461547e63036b88e8f4aa119712541503dc7ec53b87f21ac27bd8ac06373b5cd14e6d88b8ab063b7eb610af8fc3f92131ab9b4b6c503cf3bce752f3
SSDEEP 24576:XAebc46vVa4eZwq86QAhhUkXuMDtz6Blg:webcFvVa4eZw6QAhukeMJz66
TLSH
T133552319942A0D9AFDD102F2F6D8F495C9989CD6B15B216E33AFB8599FFC0F80C8115C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-07-09_142823_3188-4360.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-07-09_142823_3188-4360.log
Size 1KB
SHA256 274f550f64fec05c889eee5c5eb9c4e90e97377f292bcfe288b3928afcbc99fc
MD5 8dba551262fb3765db4d74315a295454
SHA1 58cc5defffe3d715ed49d594b11fa8840a6a8028
SHA512 dd9619b6080d3647a241a48d41e138f4839533752f69955ceb7eb57b84b748d2f3c7ff14c03ac553d01e2bdb4f47bc2486ba809c7b17a003694add86d1b29ac5
TLSH
T17521AF1A6BD81A05FBFADE8298FA15439E3978922831CA4C40E4438D0976F41FEB4367
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 10b7fcdc24b39894f2f70d60f4e99b3b8b5c7f4edca49434c9b81780f672ff7c
MD5 ecfb58440052a43eddefc8171b9ad22c
SHA1 ac316b91f12d7fccdb052bdb6c664ddcceabe871
SHA512 35f0529d8ee4a48ababb35f404dc94786dd3b32208d390a8c08690f9fadf1c6488314e4bd974d271180ebc9825d5d30f69f0b654b6c69e9251e8822325e43223
SSDEEP 24576:KBebc46vVa4eZwq86QAhhUkXuMDtz6Blg:uebcFvVa4eZw6QAhukeMJz66
TLSH
T16865F00AD25806E8E4AE12B5D7959941F3737C6593E2A3CB23D0F83E1F794A05DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4f2b0eb558742f68ec2d9ee3c77dc19378be1d73e00cb62c9873ad4213e242dd
MD5 24a7690e3c47329b23c11706911e8319
SHA1 302f64aad0d747c77aed6a508fb729e67048e7d6
SHA512 741e3c57ddd9195e6a57ca2e676e64a6abdb819c75428121703fcef2ffcfd0fda878de8b7502647e55019bd8184dde3553b5177b04e6b2572304afcced54820e
SSDEEP 24576:A/eebc46vVa4eZwq86QAhhUkXuMDtz6Blg:A/eebcFvVa4eZw6QAhukeMJz66
TLSH
T1B055331AD12D0D5BFDF202F1B198E424495DBCA4B70B619F725A78ACAEBC4F48C5031E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 026028adcce2db9c09970c0dcdd2298e662a0d05c55acf9eaf9fff844bc49922
MD5 951b441196b26931c0f98e5906d3e758
SHA1 7030e7e4c5b842492babc7a074c800f651d0ac6f
SHA512 98dfc4c638fc8690c3457948fd7531df8f137f354a5f892900f26be3d03800de28d9c8665b0d90b121864918952e03c081dd8ee1be266f7a04d9a59e2523181a
SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQleebcFvVa4eZw6QAhukeMJz66:oa0hNYG4JwI7bAvVa3w6QA0dMJz6
TLSH
T1A585AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 801696f7731cfe095af5b2deb77c89d4339190507aeb725d54c4068b96f522fd
MD5 4df9604bd6157b7a5644bb3aa6a4c7da
SHA1 ef663b0e9dfafe164519a551d55ce0514331c265
SHA512 6e412c07c40fc83c31d13a2b94d65139ac8ed366f1e192bd013b536c20901e7645d431e7f1bdbc0b6891c1c1583b740dce51819166322a3050f2f4b246aee1e6
SSDEEP 24576:HhbHjPTebc46vVa4eZwq86QAhhUkXuMDtz6Blg:HhbHj7ebcFvVa4eZw6QAhukeMJz66
TLSH
T1BA55127E12AC14D9F9B292BDA695940AC771BC652312A3EF23D2917E4F3B8F40C35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e89833e599e6fb5f0682980142dc91e3a010bf8ee6fa027b0a6129f7848bafed
MD5 0a69ad67af468414015f50b08097e1ec
SHA1 895851b87f628b0681deebe91751a75f23a1bcbe
SHA512 5409ff25e996eaed286075bdb77c6b19dd0df601524060e88fdb5fea49c2de6bf106f322332c59d6458a78d3a265776cca87d8a838812ca16a05df00407cdffe
SSDEEP 24576:Q3YgnJcRTk4yti+R5dBR/rebc46vVa4eZwq86QAhhUkXuMDtz6Blg:QIgnaTk46pBR/rebcFvVa4eZw6QAhukj
TLSH
T18E45BF2EF2B910B9D8A6D236850147B5FB71782D1F209ACB0170C538AF1AEE85E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5e41cbfec27a4c6b9c1d04a2215b37a491f0bd698efe4322555065c72b9c438b
MD5 39203488cbbcb4bb79552ef05aa54898
SHA1 90286b68162fa0c66683bddc14a2a804bccd6c01
SHA512 4c8a79d99b503dafe80028a9a12ddf7d296c081108fd2c6c0b7c3cec7d08d0949a37557abb2bc8aa22038f01f614ee36e79df92d922a87dbc8e1fa503ecd5ff3
SSDEEP 24576:xDeebc46vVa4eZwq86QAhhUkXuMDtz6Blg:xDeebcFvVa4eZw6QAhukeMJz66
TLSH
T1D3552349901A0D9EFDE102F1F6D8F4558994AC94731B22EF32ABB8699FFC4F94C6021D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 da7df7a0870ea5039865c443f419b6bd7209aea5c7755ce91589d446da8108dc
MD5 98714667a0d50748a78172f44c641415
SHA1 8683c05da762527567a3e6998b8f0594770b43d9
SHA512 30730835c21d5dc7e156bf049a8202c77ebf0287b76a5b59476fd11d8693a7a738205f437ff83616d5b3c459f82e48741f4707599b885c6daff8af50a9b1798c
SSDEEP 24576:9bL3UTaeebc46vVa4eZwq86QAhhUkXuMDtz6Blg:9bL3UOeebcFvVa4eZw6QAhukeMJz66
TLSH
T1F6750115E6A404F9ECB7813CC9A6D916D2B2B89D1364E7DF03A84A691F732F14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 91e285291823705e738648a683725f4bcdc2e330f04329e9a772df7167c5126b
MD5 e5171e94b04f1bd9701f5a1549d09a97
SHA1 62d9b2ef2fee63f24f425ba5cf51835bdf6a90db
SHA512 dec94b9bef9c99ec93c01bde79a8f9520f0776e9e963d4bcd4455f829b35d1468cbafbbb4d7b7da90ef5f40f522b8deb818aaddeb03168684786308eef1e23ff
SSDEEP 24576:7Oueebc46vVa4eZwq86QAhhUkXuMDtz6Blg:7OueebcFvVa4eZw6QAhukeMJz66
TLSH
T18D55121A32AD14E9F5B2527D9A92920DC3B1BC66132213EF02D090BE5FB7DF85C36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 51acc519b4e9e0b35811bffbd1b7a5b649dc57efe4e6cd5cf87952e968ef079c
MD5 d93ef2bfefab0f612953b308f55aae5a
SHA1 90994d09a4fbb077f680be9963c0a0e772fa3235
SHA512 f5eae50f45e8b449323e1c6b5fb1e4532ef9808f8aea26ea50595475b17fc2c103aa52f9efb21d915c59dca72afb9777bce8926fe0b2c88a8a53ab0e319c1e88
SSDEEP 24576:V7NM9YqZqmWMUkPjZM48Mv6bEhsveebc46vVa4eZwq86QAhhUkXuMDtz6Blg:V7cBWMpPjN8DbEhMeebcFvVa4eZw6QA9
TLSH
T1DF659E2E6BAC81E5D477D13DC9A28605F6B2B4611B318ACF1162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f50d4e92701e0a7cf40634c50999bc7e8075650139c2bce4c6b00e888f069cda
MD5 ad2ebeae3f927cfd21c9cc9f23089bc9
SHA1 b937fe85a216cf0ce456095fa02152e9bcb80fc3
SHA512 e71b15aab5a034bf5a2c5f564255189a99a5bca533b05fd66622d671fa433d4616b6758cd1d218d9c32860f8d4603e206fcd68a29e66fd22537917134c1fe26f
SSDEEP 49152:9F2YuHNETovAvNYf8kmPeebcFvVa4eZw6QAhukeMJz66:I6BCf8ku7bAvVa3w6QA0dMJz6
TLSH
T130858E6927ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3565f6af587da3b58f823dd93a596250b80b90c0973dce834a2b2beff81f2139
MD5 4393cb49c2ef8f6e34d69d82eccaa461
SHA1 d34ac63989d62cc36e5a7188c374de030d93606b
SHA512 578754cd768adbccb7948c26a2075ee937b90644ee644c573ff8d7823bcab69fe8b6146a8cd2045e0fb1fff85d4ee457ff10a2cc482a1db6ded95948a6697fed
SSDEEP 24576:xAFs06+OmlfkNXEbToSeebc46vVa4eZwq86QAhhUkXuMDtz6Blg:GFs060lwXuFeebcFvVa4eZw6QAhukeMz
TLSH
T10065AF2F62AC00D5E07ED17D8997C91AF6B1746307255ACB0260867E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 bc3829fc40d886aef525ebb4fbc2faa87e4afbdee9f923c48458fd29db9471db
MD5 6bff77db05f6d375a2eff2866ca1393f
SHA1 2ae18fa3f552a3818589c0db55f62414ad4b7a31
SHA512 0b8b854a211848a7f6a7cefbf51c7e34cfeb2a4e22607f5d973d04140151fce3f2c0ad4746383ccaa364b31a0453e6833bec62c00857b62225e4f8e8a8c430de
SSDEEP 49152:xJnJ5DGXFeebcFvVa4eZw6QAhukeMJz66:47bAvVa3w6QA0dMJz6
TLSH
T19775E12DD2A810F8E4B7C2B481995755FF72387D2B2269CB24B4D5353F22EE09979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 774c41aea7b7625af5ceaf090b8b38e1f6637fd9509cade3ebdfbc75e36d01ca
MD5 e68b9c41adac4fa63d80aef6ac3ab81e
SHA1 f19f574b82e060f2dbacca54d989138f8062616c
SHA512 f5e64bab97bb7433f6f51b7f09b6ba1ba446b6f5d312a293812da3d3d1c009e39fe8572f731a6b6a707b27618c37662e6dd2dbe7b90f4660b9f4c60f0318a197
SSDEEP 49152:8g06DIKdwc+eQnSt65aVbeebcFvVa4eZw6QAhukeMJz66:tx7bAvVa3w6QA0dMJz6
TLSH
T188956C15B7EA5294E8B3CAF1C962A5169B327C509B34F7DF0AC0C92E1E33AD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 be31724981fa189c0c1e21a8d801f63c8f362f506ae9f631cf40cad1ac7a65d4
MD5 022d980ba8bc6b69ee01d1a80d414cd5
SHA1 f1763ba7c4e8a9601ba8578d3325937e606c8f1f
SHA512 71a04b955d855c03cb8d0736ff548d9ecf2a945421a1968f89160da7c7ba8f8c947cec238f0fea9cdb2ce1fdc7af68b64455bf758655c786fd72908ed88cdc81
SSDEEP 24576:MnKebc46vVa4eZwq86QAhhUkXuMDtz6Blg:MnKebcFvVa4eZw6QAhukeMJz66
TLSH
T13255126D26AD24E9F962417D9590C445C3B2F4B0675327EF22E2E17E8F7A8F91D38B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 b6734c098e12111c1b129448336871e472e5eae0ce916e2069a107d3f660d73d
MD5 bce81c3233e95c72f55b8087c1d51386
SHA1 a910a0a7af991eab6b783d83bb3f892d96f6d335
SHA512 7ac53e5a43aeb0356d7ef37667f2f6beb87bdc685fcb3555da2ce98049c1add017df2b11d3118cf562f0e1d7c50de49cb265db207a4804c0838e6ad4bd5ab8df
SSDEEP 24576:NIy8eebc46vVa4eZwq86QAhhUkXuMDtz6Blg:NI1eebcFvVa4eZw6QAhukeMJz66
TLSH
T1E6651308635818D9F9F20274EAA6D0948E74BC306B2653EF61D1FA3EAF795F45C30B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d8cc06aea62d83672cf7d08b5e9997ebf4755141c5a2a9edf90646c07f8a2451
MD5 1865cf988e9732a63959b8f5400419ae
SHA1 0cca1b82908afe7c5b77b5a56f24085ab90754bb
SHA512 98b85ae03251e771bfff84fc8aa1889ef1529fc8bd1e1c7e0855b2028bc028ea1639681cbf86fb054b73d2ab273d68324b09533e8a97d740daa9cf82abcdaf59
SSDEEP 24576:H+eebc46vVa4eZwq86QAhhUkXuMDtz6Blg:H+eebcFvVa4eZw6QAhukeMJz66
TLSH
T14E55231C502A1DA9FDE202F1B298E85585A47CA5731B31FF31EAF879DFB80F44C61949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7fb8c7bfe2735b922d79e277663664e404656f64ee2db0585d7572a5011fa766
MD5 7b9c0f72eb92532f0fe9669c598c348f
SHA1 805908f5ab9bab151c6f60e7ad021d99a9f2a038
SHA512 fa4d7f04bf1907b40fa62680e3be90bc2e3262a02abd7f8b95015d85401d7631ca5a52c519ac4ecc7ff1c059a5a8eb974febb41565e3af089fd00ef329cf123c
SSDEEP 24576:0Q9MxZKdcz9dw3neebc46vVa4eZwq86QAhhUkXuMDtz6Blg:0VKZneebcFvVa4eZw6QAhukeMJz66
TLSH
T141558D2DABE9099AE173C275D5A250C3A673B4311B35D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a76ac9041ccfa0d69d21b00a2733c40d37d55b3089ff98b17110a076e2a0187e
MD5 29d3dfdeb789aae941d7e1601723b6ff
SHA1 52c2aaa640b63b2404e123a6166256be33369acf
SHA512 7cd47b741ab05d01758f4a56f73d22dc02aaf28c51450412eb5d44d8be8585b36e8041b11fa62b803a89f6252ce60fe0768e499363c93fdd8e24718892d11b37
SSDEEP 24576:0yocDApAeebc46vVa4eZwq86QAhhUkXuMDtz6Blg:pocDApAeebcFvVa4eZw6QAhukeMJz66
TLSH
T1E965E01FB76E00A2E172813C89858645E7B3B4706B6263DB6291C73D8F779E8BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d729e53e8b0892cfab92e5a44e61f63151beb71f3db2f83c2cf3e71f49b1fb5c
MD5 f439544535372ea6a62331d3e767bc7a
SHA1 75f65954915585caeca58024e0c970703a308065
SHA512 1e3e98b79ee5a931a8a0bb6d7ac3e4fb31aaf5d29c45554e3c3deed0fe6d606c3c9fe9e3877453cbe0ca39bc85dcc23d3b2641b6e5a7a9f53873da3ef1dd7761
SSDEEP 49152:jWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKAeebcFvVa4eZw6QAhukeMJz66:j0zuNIa7bAvVa3w6QA0dMJz6
TLSH
T147A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2065DB01B0C57CBF2ADF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5655930fa123d07b3c9e78a8ed3673a6511a533166095837258a81daa70ad498
MD5 8c617c961055fc557605604494ce9191
SHA1 d012a176f0eb148111d5d29837bcaea8fe68da46
SHA512 f1cf782a409814fe7bba6f833f710c6e407f4208249a89ff6dc3feefbf12fc000a6c332a0a6b3977c1027710cc40a3a61531973623789c3715ed4e01e06a82a9
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYujMqbKebc46vVa4eZwq86QAhhUkXuMDtz6Blg:uTDxR+N5YzT4jMBebcFvVa4eZw6QAhuQ
TLSH
T16755B02EA7F815E9D1BE85799A23C512FA727821033193CF42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-486-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/872-334-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1708-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1708-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1708-243-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1708-65-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1768-244-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1768-89-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1768-85-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1768-79-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1772-262-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1772-324-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1772-256-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1772-264-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2064-485-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2064-330-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2192-22-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2192-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2192-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2200-390-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2200-412-0x000000000C3C0000-0x000000000C3C8000-memory.dmp

Download

memory/2200-488-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2200-406-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2200-374-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2200-408-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2360-270-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/2360-329-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2360-277-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2360-275-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/2616-302-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2616-303-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/2616-309-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/2616-416-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2972-44-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2972-242-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2972-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2972-50-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3188-8-0x0000000140000000-0x000000014046B000-memory.dmp

Download

memory/3188-0-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/3188-6-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/3188-34-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/3188-36-0x0000000140000000-0x000000014046B000-memory.dmp

Download

memory/3296-409-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3296-283-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3296-346-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3584-241-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3584-15-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3656-322-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3816-316-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3816-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3856-252-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3856-320-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4212-436-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-442-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-450-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-452-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-453-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-456-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-454-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-455-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-451-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-417-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-419-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-420-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-423-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-425-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-418-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-422-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-421-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-424-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-432-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-431-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-430-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-429-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-438-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-448-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-447-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-446-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-445-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-444-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-443-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-426-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-441-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-440-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-439-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-437-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-427-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-435-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-434-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-433-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4212-428-0x000001B0B9770000-0x000001B0B9780000-memory.dmp

Download

memory/4552-314-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4552-449-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4604-414-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4604-287-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4620-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4620-415-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4620-297-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4620-291-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4968-484-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4968-325-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4988-54-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4988-97-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4996-333-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4996-280-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/5060-87-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5060-75-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5060-91-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5060-73-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5060-67-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download