7476f0c6a9060106159303c3c0a2bc3fcd4600e6e45b2f9b8a7812efa671cf8a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_ebe000ad9d731e000837147a032f8c94_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
Size 2.3MB
Sample260804-fm1kwsdc83
SHA256 7476f0c6a9060106159303c3c0a2bc3fcd4600e6e45b2f9b8a7812efa671cf8a
MD5 ebe000ad9d731e000837147a032f8c94
SHA1 8cb55aff0b3e0efc174b64a53caea46127da9705
SHA512 1ff417a198cc431cfe1177457b6a2f7bc03764cba8d6c4e6465c694e897c84518231a434efb19033f1521d25a2d75974d8df1e28ff46a72ee10ee445b8ec3efe
SSDEEP 49152:WZMBaJ66okeb/z9b5+Pl6bJTIZ5jdgpv:DpslgJTIZ5Bgp
TLSH
T1C8B53833729AD0D4C40D9174CF165BF195A17CA9CBE5A7DF02C87E25BB369D03ABA208
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1252	alg.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
1496	elevation_service.exe
1792	fxssvc.exe
4568	elevation_service.exe
400	maintenanceservice.exe
4964	OSE.EXE
3284	msdtc.exe
1648	PerceptionSimulationService.exe
2960	perfhost.exe
4656	locator.exe
3140	SensorDataService.exe
2548	snmptrap.exe
3412	spectrum.exe
3752	ssh-agent.exe
1960	TieringEngineService.exe
1516	AgentService.exe
3160	vds.exe
464	vssvc.exe
4540	wbengine.exe
4976	WmiApSrv.exe
3628	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_ebe000ad9d731e000837147a032f8c94_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-04_ebe000ad9d731e000837147a032f8c94_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-04_ebe000ad9d731e000837147a032f8c94_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_ebe000ad9d731e000837147a032f8c94_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_ebe000ad9d731e000837147a032f8c94_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e33d3c7b7c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c259c565ce23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2e40964ce23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033083064ce23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d7eeb65ce23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7b57e64ce23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075450c64ce23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068416964ce23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d457e465ce23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
1496	elevation_service.exe
1496	elevation_service.exe
1496	elevation_service.exe
1496	elevation_service.exe
1496	elevation_service.exe
1496	elevation_service.exe
1496	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1492	2026-08-04_ebe000ad9d731e000837147a032f8c94_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	1792	fxssvc.exe
Token: SeDebugPrivilege	4552	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1496	elevation_service.exe
Token: SeRestorePrivilege	1960	TieringEngineService.exe
Token: SeManageVolumePrivilege	1960	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1516	AgentService.exe
Token: SeBackupPrivilege	464	vssvc.exe
Token: SeRestorePrivilege	464	vssvc.exe
Token: SeAuditPrivilege	464	vssvc.exe
Token: SeBackupPrivilege	4540	wbengine.exe
Token: SeRestorePrivilege	4540	wbengine.exe
Token: SeSecurityPrivilege	4540	wbengine.exe
Token: 33	3628	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3628	SearchIndexer.exe
Token: SeDebugPrivilege	1496	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 4912	3628	SearchIndexer.exe	123
PID 3628 wrote to memory of 2988	3628	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_ebe000ad9d731e000837147a032f8c94_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_ebe000ad9d731e000837147a032f8c94_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3284

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3140

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3412

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1244

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3160

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4912
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 492f8ffacf0e7639eed8a7eadff71654771f0ab2714594dd417f7a9fe3eb3045
MD5 f73d9f4dfe9d8030093354f497e9868d
SHA1 0ba5c020e18e258497783997ca791586fe904c6e
SHA512 cfb0d5294ffcf7f9015e9faa67c92a5dfcec0862c93dda22df8f69dc1feaaea5c5147cf1488cc8cc7f389f1fb39909ec240fdb6d89a46e4f99bc04f051764ab7
SSDEEP 49152:Ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrb5+Pl6bJTIZ5jdgpO:q3q6mjByslgJTIZ5Bgp
TLSH
T11DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 031a0ec3df683b0d4b3c3b789580638cd55b4613f6b4f63b4894e5fc2d93cbf5
MD5 6d50e2fb45358490e3c638b19eee4bdf
SHA1 f8467855bd0a17291bfe2a38986077d7d3cd4db8
SHA512 0caf01248f230acfb0941a1c754b8e9f8ff01d194fa866046b82a132a448972003e9ae10963aa78afb018d7187c13e989df2d36b6e8f63fd70de2c74243ee1cd
SSDEEP 24576:SXYfDtczAVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:5tcJb5+Pl6bJTIZ5jdgpp
TLSH
T18185F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 7886912ece3b62b881c89667c6968d204739a58ccd80ed5fbc8b54523ef1a37c
MD5 8ddd8b15512da45ffd96295a8be1b87f
SHA1 ee33ab37939cf19ac9cafd542b93311f3fbcdca9
SHA512 b15d4683b057ddeb0c23d3600db79e70bc726dbbff21532e44e9419165ca91e29448f2eae9a84df133bcb93355ba4ed0be0b3655424588c820c120a0a01b3047
SSDEEP 24576:p0Le5ji0hmxyrM0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:pPji0AIib5+Pl6bJTIZ5jdgp/
TLSH
T14295AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5f561fd238df73772a8ba5eb098c6d4a872196d004b109379d175aecef14c224
MD5 65839050c84d273d6131cfa31f0d9a14
SHA1 0a2a6e5f35092cb48488a8861616c8b502adcd56
SHA512 d75135386dd890f63a9e64d19745dc7e672e32ff5ce346e084dae32e61d0053fca2cbe6b961c7c38c0e1fa272a679ca958fed5d5b0a071ceaa276e21fc1f4b70
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWj6q8wyu2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:I/ezSC6vUzPv+HjyGb5+Pl6bJTIZ5jde
TLSH
T1D1756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ba4a108f2a3a0694ba5e7c506a21e46fa5a51d3b01c41ff7d6f6bc937615904e
MD5 924bff40b4fb558c93c2ac060030b9cb
SHA1 0fb8fda3ff2542c849dfc3be95f7af32bae0677a
SHA512 7d7914ae746d2e324b12af6194c6af489dd2007e217c86cde2868f77e2ef69ac2ca8fa0eec9fd3914ad1f3be2aba9b47154bf64b1af8139d9246b4b52e22f0be
SSDEEP 24576:ZVbqPb88hv/l+BZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:ZVO88hXl+Cb5+Pl6bJTIZ5jdgpI
TLSH
T132559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 fd4609dd56c37fe6176c76883367c3daff0930705292e6ad2886ca3c68163218
MD5 0e8ee712c2a788fbef8346c04e11aaaa
SHA1 fa0356e1bac8da1d83968c405c2ca854c6a95f37
SHA512 417eaf250d29b1c2a9a65c2d31ff267ec1c72018778ae6e50cd640779a7b84aefff2e2bfb54d17dc5a30bdf2d1aa0ea5267950c14f535061824a87d8e47eb7c8
SSDEEP 24576:wFomb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:ob5+Pl6bJTIZ5jdgpJ
TLSH
T1F56523834B6930C5E5AB1739E9CDDB00F879EF55CD866BB6C579282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 088b65412ce971049ae264865a62dc9fb0752aee5195c27f2879d863242e3fda
MD5 723102014076a51f631ba4a50a11b192
SHA1 fe730acbb9fe0fb434a376a86b76eb1ec20d0979
SHA512 5cd82606746a32b88550c017c68ab5f1de1aaf2fb890d252ab6e9088763fa329fbf1701bd0de98736022981770c2264dbe4ad6004b4d9c67c9235045042a7be0
SSDEEP 24576:8JIUxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:8JIUMb5+Pl6bJTIZ5jdgp8
TLSH
T1AD85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ad2eb220322dc641a1ee68e811acb2fed5dbfcccfece47c658e178dad471891c
MD5 52b36a4ccc14151d6bdb34d66db4ae60
SHA1 d259e8cb3f5a2a38207d8ec0f44b3518ea077f57
SHA512 08604cc765c28560983545c82772e21ec8df21af54b33d8313ee616ca26c3002125dc20963e06ed41f18135dc9d82435e046ae0ca04e0c4bfc06cf10ee10312a
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THc:QQvGAdlCEL8c/WRNw5C1slgJTIZ5Bgp
TLSH
T109266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 1ae540b96f60b7a3aa8242909c88d04371b8af4cd8cb4cfa8daed13f50848cef
MD5 42998f24b2a2bb187b304a3574cf902b
SHA1 ad705a5e21efbd4f6f6f5ff8d5daa7059bf34b81
SHA512 1c7e20c001fd190ba8a49879e73fb786d24ea8e548a04c27e1510674b0af15e4d6ace9538885ee50c2dac49d38f3c01a8e5ef3e1e90f21733f54d2975856e79c
SSDEEP 24576:0OewsAjbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:XljSb5+Pl6bJTIZ5jdgpy
TLSH
T15585E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 afc4da241317553484ab49195e936b9c44f802566cbe3cd7fa42d24910a68549
MD5 7a53f96b9cdef3744a71b18cb624e920
SHA1 d40d21beffbbd8a76b2482e901917065b8a85467
SHA512 a87fa1092d15976e9cdabdb21006a275e17ba50a38506b76277853c6f1da9b3884ff2f50d88bfb5867f6e9a528aa262b1113858194e85530eb73c6669eae4ff0
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHQsT6p:QUEtQevvqc2W1cpV20I32Qs
TLSH
T103474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 684b6d178180817c0006e5760e1313aa065b3de3a02222505500cebb71bdd0e7
MD5 b442a79ee43ea94dc33ab7e09782bac0
SHA1 5cbe3dd756216cd03983e75669ee039c52696ca0
SHA512 a841a235a5269333bf437a91a84b457a4383d17d5c3759738436e10e73ad1122c46a97aee2ed0602d5e3b64fedf36ab640c29f78f26fc2229287116ebe49b4e8
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zyb5+Pl6bJTIZ5jdgp2:1oqtVjnmJslgJTIZ5Bgp
TLSH
T1CAD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5692aa580fa87e6bcaa384452ecd28b384a8eec6c65a9526517d9abac4cb3759
MD5 1504173eb2b6af12f9d3e6d8bde616d5
SHA1 5665c9eeabfea55c50a3751b823a8e915f42120a
SHA512 29f75a32108d07a384b5333b19f4d651eae1ce108e23a19828f18b6c13a0ccd6b5a61df9cb2aaa06e0736bda02d5b77c9927239d726758aab11e56a7b89fc845
SSDEEP 24576:TAhGL6IFoiwtA5l7S53ymb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:TAM5Foiq5Nb5+Pl6bJTIZ5jdgpl
TLSH
T1A9359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 6b784b84d778f55417a5313b8f09de20902c1d9c6677096da7e1a495f8883a72
MD5 2fb1491b74a016d2758290229b82a545
SHA1 4547c1a4689f9a364523a9422d97e1151635c18d
SHA512 007c77fa47d414dafc6efa1cc48bbed7e9fbe5de889c1bdc9295f8db364047313300afe10a64c7ecf34e1165b565dc7474bb9249cbd1694cb58591af1f04df18
SSDEEP 24576:KwuGOWnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:KwNORb5+Pl6bJTIZ5jdgpx
TLSH
T1AC75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 727a6f9536f5a6e3e61cf08ab4821c1f81a35dd3933576397ba7080c77b38104
MD5 b776de784b713c6fae85f886a14467ec
SHA1 828a5fb0d50b60d107862d08479f40f8fe8c4c91
SHA512 93d3add8cdf18e9e23a90b63065cab506730bd9f66f47b206a37a71a7de8cb64f8f91d6a6e4ddbc458a908e05dc1a35bb715723f90d29bb9f19e6f7ea8ccb41f
SSDEEP 24576:fZuMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:Kb5+Pl6bJTIZ5jdgp0
TLSH
T10865128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 30f30604399725ff3caa359d07b3135b03b4ed9edee424333d14de8d814606ec
MD5 011105714e2de9ce9e932be7bc629a9e
SHA1 f17ea08420a8de4e648ceea9a3a7df6d581a15af
SHA512 ee8a39378115e9210c8e62bf607c368a8de52e5efd0c271b7d5fb6f8341d1f2981f276078e2cee56928208f9df285d30249d1f21d8854277ab85e3195f78d4f1
SSDEEP 98304:YQRQyi36YOcPDLvw2gAf+PN3eslgJTIZ5Bgp:PQyiKanX+PNOsT6p
TLSH
T18A666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a67f68bf8806462ed43e28e6081f9630a485dd195318cd08274f995e2847fdc3
MD5 a94160c840e6aa9002197c4316421203
SHA1 4e0340b0f24231680b2aba9b00f13e71b210dc04
SHA512 0afd5bea5a0c7a7f19b1e6063cb67c2ef76683c49357b75cc035ed2cc1bcdc85928df1ed259d3635232fcf383b57b0e314654f7d2809aa47e107dfca6829b622
SSDEEP 98304:3QRQyi36YOcPDLvw2gAf+PN3eslgJTIZ5Bgp:mQyiKanX+PNOsT6p
TLSH
T167666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5f0c05164419fb7ebb651d1f8f55e9c774a6f3f73ee5aa4f511bff59899a32c5
MD5 58c5622c28231632f8f791b8c0b27542
SHA1 ef8b34b66bbfc3b075efe57722e8964b7319a806
SHA512 0776bd5047f61c53e0ae0ac61e7599e06bf3e75befd4ec272622a630e73050bbf0823078cdbe79928d0debfcbaf768f8c3dd1f996e381e7a871489e74a0039bf
SSDEEP 49152:M68Qg55nhkeWu7PNU3/ib5+Pl6bJTIZ5jdgpk:GthTRc/oslgJTIZ5Bgp
TLSH
T1A6B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 30abaa3d231a2df007c6551f6e79350d815b819d776dc24b3875ed5d2cc89e15
MD5 451bfeb078bc51d85afa25aac89d0048
SHA1 4755ea81a96ce34fff0919e40c21419d050a8c42
SHA512 e089eeafb3315661812c761295e591896f3f2447ef7516664e458aaa4971143d5e4908fae1a7feec2b79562ccc6f9775d08b8201ff629f7d9c18072e92bcf7f7
SSDEEP 98304:sy5112gYy5azzVvU69nLKnhZjslgJTIZ5Bgp:tLIHRWhBsT6p
TLSH
T1F8167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ecd7c630d6cef4e6801860951089f5e04a2109405ca3cc93738cade5f35c1e6c
MD5 438ef25c0ec0fae83f0d07a43482fa82
SHA1 b172d3fce6d60af2cde1681a38d8de305a145db9
SHA512 e695daad668cda00c85addf51430b458b2a73eca0eaded832f838184934be9bf39a50850d52f68313b59df4fece873a384edaa4ccc5f7383b736ac0d46ed92c4
SSDEEP 49152:9B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glob5+Pl6bJTIZ5jdgpx:ju6JmIxd2dmslgJTIZ5Bgp
TLSH
T110D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 85eb1e6bfb37874f2306a8a2e678a9e49b4831e3b03a5c74296daf9529ccf1d5
MD5 116db18fac10c92aa1f65eef0a0d41c1
SHA1 9c634d5ab64faaff0792af876873bd281584d13c
SHA512 d9c79c840a8f11f01e99c0ff437eaf739db6b1aa821d7a58c9b61d26d13d6d57d35e2db131c3996c6602cbcb748c39efcabe6dabaaf9973a2a9343b3dbabbd94
SSDEEP 49152:W1hpsNoJpF1A67U44CwH7R4xsb5+Pl6bJTIZ5jdgpM:WmifPqRJslgJTIZ5Bgp
TLSH
T191B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c340fc34950ebad963765a491f858bde747efdeaefc39680c105489e1bd016f6
MD5 ca1cac4da32ec73f523b41d3c34b3ccc
SHA1 2a2b0d5b5314769be8abd7f433ad29d8358916e3
SHA512 e6c9b0087c37192f4bfb1b376c48ca5506483ba5055e257d4d58030462e151c00100d5f0ee2f45cabc993d8c0b6c1492bda5fb148f8a68ea28a6a1db3322e2b7
SSDEEP 49152:LSuZQIY0Be2KkRVtOnks6NMHqbb5+Pl6bJTIZ5jdgp8:Z5dKqi61vslgJTIZ5Bgp
TLSH
T103C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 19e079210623a76095678cc2cf45963243af5105cb3b5abd5a5f8157c1bab587
MD5 986a5e2d294b3399e96889de8ecb5258
SHA1 1e75bab20ea4e54a84e3b2b8e2eed2549b8e7096
SHA512 ba3b110552051fceaee2ab556ae88e796fdbc32cbf30a7b7a63ae06e87247109146d2409ce600b31701158bbf1c54b6ceb71e2048281dc18ef6b3f523d6c2384
SSDEEP 49152:HhtSn8EApI0figjgiDn0AP5wYb5+Pl6bJTIZ5jdgpa:WX2iWphtslgJTIZ5Bgp
TLSH
T18D95BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 87da5471c2e8f95d3902bb1ec3216b7299b9fe5cf78f4f8f6689bff841199aeb
MD5 3823902479496d67086d2959a2e06a51
SHA1 ffc0ed57da9757ffc9eb52c28db965ff739f0dc0
SHA512 e601e464885bb19243c47da3817c35f0bd4d7290e7b4e0c5ea4b97416f2c3a468946dc89bd18d41d4ede537a76aaba9a1411a2cc75e5b13ef2e024ba43a6afe4
SSDEEP 24576:Ygmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:ib5+Pl6bJTIZ5jdgpm
TLSH
T1496523824D6B20CAE09B5779D9C9DB00F87DAF96DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 9f9e672905cc550b3e3e43afd052eacd14595c51f667e6c1ba51fdbb801fc8c0
MD5 9b137ccf81fb8434e4e9fb8aefab2ffe
SHA1 4204c77039f2051ecd82aeb4fb8bfc145db5b3c2
SHA512 a91d2935a2985b4e86da8a0695b66a89b4a892c9ae8fc2a3bbe77828cdd7913c6b720d715efd9f3022abe4e6245f9bc8350ff4208cb09ca7f63b6538046475f8
SSDEEP 24576:qPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:Fb5+Pl6bJTIZ5jdgpm
TLSH
T1276523828D6B20CAE05B5779D9C9DB00F879AF97DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 11a9705b29619f87629f5476590359cb00ecae17e152cc667ac78bbf293ed72c
MD5 ae03eb27f0de6fd4e3ee10d942993871
SHA1 46184d64d0d7f83e9d48687624bfcc9f9e423559
SHA512 085679009d9d753c2215b34a34e1988c80736534a9204e42a9c55c85aab08f22578b497fd1c8dcc3fd51d18a21f8af64d95189a0456c830ce19f16c6e18de947
SSDEEP 24576:Npmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:6b5+Pl6bJTIZ5jdgpp
TLSH
T1456523824D6B20CAE09B5779D9C9DB00F879AF97DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 52969323f34c9a6ba2ea75f175dc3e8864007581d8d3c892f31c0c99d7785a6c
MD5 d8f5a4b58dcdb7132f3a3335df774ded
SHA1 aac967f53fb902d81cbc9fc22e8f096ab10d4dfb
SHA512 bb79e409cd504a273752cd82c058d0c9f6a750d6e88be2cae7b1e7ff237ca80cbe512fd69abff4e241d9e769dd2e7f8312f0e70c301475ba31460e477c861a71
SSDEEP 24576:Bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:cb5+Pl6bJTIZ5jdgpi
TLSH
T1AC6523424B6A20C5E4A79339C9D5D700F4B9BE96DF5667FFC675082BA931388383134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a1a5e7c249b1cf57cd1a3f67f7a5553777b6e4c1915387919547405162118883
MD5 92bf9a33929196725f3a8442ddb98dd9
SHA1 026a6400d8db1a6979680c5836d7f44740ad9f44
SHA512 a4efb858a3ab42b86cda8f4e93e755158beaebac8b302baf5d5851ef307df9085fff5c49bb844126a8034d1e4a287e8d40e2d1c94900fb3ee790b51b463aa262
SSDEEP 24576:X6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:Vb5+Pl6bJTIZ5jdgp3
TLSH
T1006523834D6B20CAE09B5779D9C9DB00F879AF97DE8727B6C57D042BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 62f9866dbfda53532859a2c49f2f19420366e825b0be141e52636f01f1dc9368
MD5 04889f7f17c44307c68bfd6435155f8b
SHA1 0df25bf20a387036afce0c7713eb803539dc1dad
SHA512 d7008dee1975a22a5dd4bf35f07d908d9844d04258ddbd7f3a84ddae1eca27d8828942203a3d2648086e49fe0b22afb5c523a475fdb171c0a76be26fdc3eef6a
SSDEEP 24576:0Tmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:lb5+Pl6bJTIZ5jdgpq
TLSH
T1E76523824D6B20CAE05B5779D9C9DB00F879AF97DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6c06c6a595104035c8f03435482d1f4f024bd33917bf2c4b2a29c6334fb40297
MD5 7cebd512aca2021aba0f5c2421719988
SHA1 4693b021b88214d613e57013f31d2a612efb2404
SHA512 cdec522ba441352bc24570f2e35c74c33eb43e560da5b0c3b204e2235de4e38deefccb679fa7e6ddd7ed01707f4c132c1edaa730fb4dfab3ecd6bb29b9d1f9e0
SSDEEP 24576:X3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:mb5+Pl6bJTIZ5jdgpy
TLSH
T14F6523828D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C67D0427F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 3b8fc986066ee969d6cd7a2740fcac97e59751581eb58664f465899178a47dd9
MD5 d54fef342516e90c9b5bf0a6ad726153
SHA1 9865d0e342bc44aa9c9a8e882255d80f9ec6e150
SHA512 4cf90ec888be47ec5adf9e7306c2ca5936af91489666c7357b544f2d24de43ce768d3a21864339974cee2ab3b798d0fe9a2ebb9fe23ab5dc0af0073d1531ee76
SSDEEP 24576:lZMazFVSOvmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:lZMazfab5+Pl6bJTIZ5jdgp2
TLSH
T1F085F295B35018F8EC67823ECD958A05E5B2BC5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f119cc838812066c924287556c3944e7f4feed64bb5d9c0c82387a3005352c20
MD5 4909d429f701a3f20eb87a481cb4bccc
SHA1 cc87a6aa47787157449789341420fed999becba6
SHA512 035a80dedde525989ea4e58004fa7e26fc3564ca7c823f15ead54e3fee90a0373b1ca00236284227ee2d2face9262827cde6472720129de0caa99e50010809c0
SSDEEP 24576:U8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:Mb5+Pl6bJTIZ5jdgpU
TLSH
T1D3652387496B20CAE09B5739D9C9DB00F87DAF97DE8727B6C57D042BF130389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 6941d6cc8c823ed4d001c2b43df3c92a576c82ef6e57f6df946d640f16b8b4a6
MD5 89d5c8d8f21be031be6fe23f6a8752b3
SHA1 ead908bac56cee8086b87ab54433a77504751596
SHA512 a43511b75c48f387bca46de0d3a848404ba2a34eb0541ea1ec6e45dbb747e36e3fcdec74be11052ab1fe95ccf68497c294d94531ad8b008b86d2466bb9a416b8
SSDEEP 24576:NYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:Zb5+Pl6bJTIZ5jdgps
TLSH
T1BB652383496B20CAE05B5779D9C9DB00F87DAF97DD8727B6C67D082BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5505c58591d87194e5cd2add8dfeb8587a94770b2b1a47bf848d2c882fdb2d2a
MD5 e4b14259ff720ef77718fd964cf7b474
SHA1 f234b945f2408675cbabb9cd46e1dbda30fa2543
SHA512 7324b0928f88ef477925209f36a4248cce22bcaaec8a05ed9d3b73f9fe2a293cce557ec0d7f03172bb7ad88f062d22d61a286c3a71403ec2f807aa6a19461ad1
SSDEEP 24576:VzyLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:Vxb5+Pl6bJTIZ5jdgpK
TLSH
T13B75024767A630F9D0679239C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 2b45d5e03ba3daeb5e3da2e0f9003921f42c1e757cbcd03672b992c7c6bf6997
MD5 437d1587458a668beb80c569d7019526
SHA1 7dae173816f6db4db84455ced92480a00eb86dbf
SHA512 9e5dedd8491b4696ba3ca1d62a3f77bd74ab37f79cfef2a1ba12092a48f629b1c978d608b50e2bf2f64381557e5fec4590ea7f41d0f44bb898bb8c838baa6e53
SSDEEP 24576:48mb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:wb5+Pl6bJTIZ5jdgp3
TLSH
T16F652387896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 40fb9459b6d9fb7c2f7c45081d78d38f41e5ea3b5ad97adabe0247a274dd85bc
MD5 2d25e9991791c0b8d4b2708af3b01414
SHA1 54f6d25d4c106646f88fb88ed99ef7ef537f62c6
SHA512 ce8a29223168d99d3ed6e4c791ba04d70b8f0ad04caeea292686aba42af4de4c9b51efb485a32727d148b10dab6486086cf7bfc53be1a78a160a37ee5bf0cc3a
SSDEEP 24576:Y8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:Qb5+Pl6bJTIZ5jdgp3
TLSH
T18D652387496B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f1213b50226c99ebecfd1ea03685647213fed830437970fcbd1372972cd83621
MD5 ab3f7fc422e52ed9063f71750061500f
SHA1 532b6bc6a40f2e6f2a13ffad33a6ff8e13b4d8d4
SHA512 4026427fd9fbe52f1b7c7eb6972ce7716195152d8f5db4a9424ac377a50518f1d37e08acafd5a9ab97e4abb5865c265797d364c9bf51c956a9032976a196af36
SSDEEP 24576:DzyLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:Dxb5+Pl6bJTIZ5jdgpp
TLSH
T17F75024767A630F9D0679239C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 0a579b29c1887a34f430102db72177ded90b5c0825ab9dc647a6aa2af2e44eae
MD5 76e5ce1ea1cc088bfdf51c1ea04fdaa8
SHA1 03cec84483f419051311126d6ce6b1a751073803
SHA512 e26e9ca82825e652812a2118371f71db491f626a27a4b6af1bcde9fb3312c4daad6ce1d810f6482099f0a9e7d6ba2e211de3285f0177fdb6aa03e48f8d22584d
SSDEEP 24576:5T/aLl3z0zD5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:5TiLlj5b5+Pl6bJTIZ5jdgpt
TLSH
T16485F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 4a6a72b904a4031e67b668a2244cf511134eb12d6f374c135ca8bf85d0c22b89
MD5 7c050d422d3eebcfda60d941f7d31729
SHA1 b447fdefc75689c9118a6ffc93a49c829c18ce19
SHA512 4b970024a68a9a208e9f7d51566e9b001562cc5f403c696777e65404f444ef87a86c99a075c35cc11dab136f6b4d397e64fe2d6eec8e83f57fabb3895dc9e0cb
SSDEEP 24576:X3Ud9CHKy7GZtmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:nUd9CHKyaab5+Pl6bJTIZ5jdgpi
TLSH
T1EB95CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 133c50cc9b701e5550a25ab931a1be407a8bb8b7d8edf12d9ffd15560ca754ac
MD5 cef77d4ae1a140d88fe1912b102d6767
SHA1 0b7b09d517126bed4f26e7248e6d7d70dae49476
SHA512 79f90b18560bf35e36c6722dbb70311785cf451a90f8a3bd585bf7329e80ab2f6e78603fe2eecfa4aab52ee200682d64540fec5a7a1ce9296b398635bffdc3ac
SSDEEP 24576:jJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:4b5+Pl6bJTIZ5jdgpP
TLSH
T1596523828D6B20CAE09B5779D9C9DB00F879AF97DE8727B6C57D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 d1adefac2f02831365e1e7d1053bf20a9b805933f4f09dad81309245a0787313
MD5 e6a86f1165014cabef40cfa8d9b1d03e
SHA1 7c2df5a97cce882ee6cd1f1a231ba8aab644070e
SHA512 660c76487abcad5470eaa9ddd38d9baa5fd2c646eef68f7aaef3a16ca1f9c6fa6ee32b4cf069ad59231494540c3f9cd6887ef9440256ddef046ac8d89807d5df
SSDEEP 24576:Wrmb57GBiOl6a8JTth/RWZvR6wQQ92pN31:1b5+Pl6bJTIZ5jdgpT
TLSH
T18E6523824E6B20CAE05B577AD9C9DB00F87DBF56DD8727B6C67D0827F134789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2dc216ab56ec44bcc6bcd53496ad488dfdcc182451bd74e8a310357e40696cbb
MD5 01f569254a2d847e7ddef37330aa7cad
SHA1 105aa84a879629dc01beda974fb2684d8ce891db
SHA512 f4203970d5cb2c845aca2c865a60761a01b584666b038e08dcefb22eeb962a4cc8921cd85da17eae4a983e15f2a9dd8f3b5bd1a4556256737a8cfb53ea512a29
SSDEEP 24576:/+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:pb5+Pl6bJTIZ5jdgpY
TLSH
T156652382496B20CAE09B5739D9C9DB00F879AF97DD8727B6C57E042BF134789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 0e0cb8f709461361e2ec1adc35112bfd2ca15e891e44b987b4f56d3810641686
MD5 0b5d024fb13939de2c8f0499402f7f5a
SHA1 eda87534c4e0b60eee81e1d2d6ead29d8b27bbfe
SHA512 546749072948001409793418214b8de4d9f6f1c499fcb7d0ab2bf9b1d363271648277412ede06b723fced66619f169092da12418910dcbdef71d85ab5fa5c7e7
SSDEEP 24576:mMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:Sb5+Pl6bJTIZ5jdgpK
TLSH
T1C775F14AC29811D8D06E6279CB858A00F7377D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 22c992688f125af6ee855df20a7af3b0af08aafb78af0f28570ed115844fb475
MD5 ffb4b643c63dd213e8682bacc418d670
SHA1 5af92ff6fe578a07dce9da1dd174140aa451ba18
SHA512 eb886f75184a9db362bb423e2e0c1159201415a54b6201c53ffc035bef094396eb02e34d6ca629045f48c8b1168d233bd44740f276b87a2bcbdd1a0ec2dd1069
SSDEEP 24576:JVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:JYb5+Pl6bJTIZ5jdgpj
TLSH
T1036523428B6E6086E0BB5735D8C9D710B83EBF65CE8666A7C579142BF1347897C2230F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8704f30d2f303d3a1be83b3d35ea54164ea0ae3e2faf3ea7c601ae73d52de0c2
MD5 9fcc0e3980f44dba8f8326df208b66dd
SHA1 50819bec5a915260e987aa0b8c74d6f6a59e0565
SHA512 6279fdf61dbdbc19d4fa6494cb452af03ae103cfc8eb48ac11de5dc806cb4256dc3cf59905d56c1a59a70061d822f784ec250953a0841245a8c5b8f0a8cb34da
SSDEEP 49152:Ua0h2GEkuAe73q3pp46zwwQCb5+Pl6bJTIZ5jdgpN:Ua0hNYG4Jw9slgJTIZ5Bgp
TLSH
T13685AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 2ef4edd3829524c1c4c75b2caaee4737986377376c028d01d6b9af1b201ede2c
MD5 52d62bc228ab7fd9fbe52c59790fdebb
SHA1 99b042106effeba95e596e80ed27c2179638acb0
SHA512 4b3559a23f8db5e6ff68c3c87a9d8f66a1e42196e8c5b188fc53580dec2f77438970e7a5de2f767b2f5a5f610a33d4c817755f32f3a98e4b4248c8c54559080c
SSDEEP 24576:YhbHjPOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:YhbHjpb5+Pl6bJTIZ5jdgph
TLSH
T1EE65126E06AD20C9F076A27DC5C5C606E731BD265B1263EF42E5813E9F37AD82C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e9e9b8eb979c7bd7196cfb8f8ee8e008a5addbf29e00b334dc67da5410ba7563
MD5 cd035139a67cf4cbbaa0b26272249bab
SHA1 855f3b9ac0ed35e36a68dae01ce9c165519bbe12
SHA512 be100edba797ffd026fb4321eac6cfbbe78af1333e6b0fc413f16ed606ce0a2c8f65327cddfd6d749ac320444aa2c2c4f82de605d7d8bb919de35ff5fffbc448
SSDEEP 24576:J3YgnJcRTk4yti+R5dBR/Wmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:JIgnaTk46pBR/Zb5+Pl6bJTIZ5jdgpW
TLSH
T15645B02EF2B910B9C4AAD236854147B5FB71782D1F209ACB0170C538AF1AED85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 4bd6bfcbe6ca129607433af14c16eade792aa6203e01a138383427b43b917aae
MD5 133f5cdfb6adf10feec5642db0d7e6ed
SHA1 acd598d20ac176f1c9453ebd10dd3fff2fc11dd7
SHA512 d9cad8339784e543ccdbd6ca4fc0262c0b1206bc238418aef3b26df6cf0601569c7fb89411b8fbb22b33a8d47e84c7e08ab35f7a1eb6c635a3e30961739baad8
SSDEEP 24576:XRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:Xsb5+Pl6bJTIZ5jdgps
TLSH
T1116523864A6A30C6D0AB5779D9C9DB00B879BF56CF8627F7C479142BF1357C9383220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e316834a647ec19984578f0dd0ae850d8bbd916c6b94165e1a1770eeb6f71164
MD5 df09dd75bffbed4e75a93bc6198a88fa
SHA1 6e4134c8d7609ca0255d4dded3a9b7b51b13cbbc
SHA512 a3c792541f948d73275f680349f34e1ca36921cf1264d03da07e1950d869f19965628e550837183e1ecfdeb55315384b81268eebba95fc89b57fd4f704f5acb3
SSDEEP 24576:PBL3UTgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:PBL3Urb5+Pl6bJTIZ5jdgpk
TLSH
T16A850245E7A500F9E87B823CC8A6CA12E672B85D0754E7DF03B84A661F233E55E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 92462deb06a72cd1254ad12ff7e88a235a704445eb66b75eafd5aa2a8fc0a0e3
MD5 5c605371b5590253ab0153af73ad1f66
SHA1 adf847043b92a8c48915f0babf5ae231458f1ab4
SHA512 d52974c0473d3535574844c9b907846b2f45d707ea1638cd3102190c426e60d1c4d1d5e60596dcdeb0ca407a522c28d7dc43af46ef517cf2fe02c1236c1fb8cc
SSDEEP 24576:oO8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:oOLb5+Pl6bJTIZ5jdgpr
TLSH
T13E75021A27ED20D5E076A23DC9C68309E771B8668B1257EF46E0407E5F63BE87C36742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d50ab4e38a9789e129c241f99376df786d87123a6232974153b44427942a1702
MD5 22e68dac92737610c2abe9cc88d6ac51
SHA1 5e9af0fb1424dcce5bf7719b0b75554a550e6ee6
SHA512 6f9747fae53eb6e5919290a7d349cb45029c63a41dca6bb34a7eec8b4c922c0ebde7e0bc845f2e6fe36785606d14a15d3814264e73dabe0e52ee8dbbed80e560
SSDEEP 24576:j7NM9YqZqmWMUkPjZM48Mv6bEhsFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:j7cBWMpPjN8DbEh1b5+Pl6bJTIZ5jdgY
TLSH
T1D365AE2E6BAC81D5D477D13DC9E28205F6B2B4611B318ACB1162833E7F37AE45E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c094f903a57afe334000545eab4f63a5c0605d83c0a05dbc0be15756b7915b6a
MD5 9c83432d0da0667ac436c976d1033077
SHA1 0151f146a61ee702cb20f395428212f1f4abc04e
SHA512 df9e3acf9bd8f79943d9317f5aad6a3665f5da4ac5d87cfd45e3fed705708efb0e4c211c48b269aae85206b7168e59f86cfc9a8054be0f172bb22b6425d0abc9
SSDEEP 49152:2F2YuHNETovAvNYf8kmob5+Pl6bJTIZ5jdgpu:36BCf8k/slgJTIZ5Bgp
TLSH
T1D7858E2A27ED80A4E0BBD27D85F6D246F9B2B8511B3056CF0255862E1F33AF45D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6ca9c06e58f2f73cbbe1862c3a247c0cba1f47eb1c78ea6ef0b12d4e18a73eee
MD5 d6e1ad57300c00b95b65f1950ace1177
SHA1 398ccdeafc504e543c0e3c3b240fb183ec6a8e2f
SHA512 56cb0f70a2d26136ee7098da52ab8d0ec6bdcb649f97ec288eeea956e1fd6063b0bcce85ed8546eddbb1e8dd416a98629b3d73e0df1255b549fe3e92086b7c3e
SSDEEP 24576:oAFs06+Omlf8NXEbTo4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:tFs060loXuib5+Pl6bJTIZ5jdgpz
TLSH
T18D65BF2F66EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 8841fb015f31a35a131bcbb40f5ed32d865077d9d28fe3ebc22d348df7d1840f
MD5 1f34277dcf4b873a23b3527d26b9475a
SHA1 073351fffef43c5f2103edc740d16f8d962442f2
SHA512 65f4d8b2aae7d519bb37a33d953e31b7dda766f510565ff8986c88b3ab949a58ff4783a47c1b34341b22f74ec998f7592fef43dc1b759e1d74f3696712ad7b7f
SSDEEP 24576:tJnJ5D3Wxrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:tJnJ5DGxib5+Pl6bJTIZ5jdgpl
TLSH
T13A85DF2DD2A810E8D4B7C374819A5B45FE72386D2F226AC758B4D4357F12FE0A979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c23016e9b5b8fcc32b3deeb8734f17d9c5608f99ecf061f11f9150b5bebdff89
MD5 dc0508f0a325ea2cc14c847becb268d6
SHA1 6ebf3863bd225e12f529d89b20448c2367fef2ae
SHA512 44d70c9b5cb69a983febaac86b6c442961ebaf7ba43383e70e4f2b136f24534254335825e9d3ff71731857986f8a09fa02320427b5524d947b86dd5030c5ee27
SSDEEP 49152:2g06DIKdwc+eQnSt65aVkb5+Pl6bJTIZ5jdgp1:P0slgJTIZ5Bgp
TLSH
T1D3956C06BBEA5294E8B3CAB1C96295159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 c02f8267c8bb937ba722c684a6fdac2000b2ba4f5567d7849107871201ccadd0
MD5 f4794513d3720e71c13b51a1d0977e6c
SHA1 c4371f58b7912b10cce77dc32168906429940228
SHA512 37c7856a4379693a5e0aac2bc980874fc255e58515ea037eb1ec817914867b5a29c1d61cded8d5e8c5f7aa2c41cf7a9185fcc8e200c36cd051b123e2ddb07934
SSDEEP 24576:e8Xmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:e8Wb5+Pl6bJTIZ5jdgp1
TLSH
T1D665015E1BAD70D9D06BA23DC5D1C704E3B2F4619B4227EF46A1813E9E33AD92D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 b28acd89c21f8eb8a5384b58a10cd8b84e925cfcd0d009123ef5e3ac531ea77b
MD5 a5ad5d02004e129c3e1bd8783f156426
SHA1 82c1336580f961070e318d56537d248d6a735ecc
SHA512 a81ceea9a9b5810dcad8c0e136b684f4b1de28055153082110cbac0c70adb0702ccba808e196685519d68b4610cdcdce967d39c7973c9c5174f86ec61a6c4008
SSDEEP 24576:2Iy6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:2ISb5+Pl6bJTIZ5jdgpz
TLSH
T11F75124553A860C5E5BA4738D9E6C350A979BD21DF1263EF80A0A63FAF36BC47C31706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 b7c8e8fcb10c41a03d7e3bf6a6d2da72a359bf5157a061061181a810f5eb810b
MD5 e325887dcae379d89bfaa24f63822ff2
SHA1 c78d32a3616f637b67754ce2bd4bff6dbeae4147
SHA512 06431a9840c3ca6a55cfe27b459e9f9f9e6f6b56fa1a90fac72e5ab24ba978426c781dd7523d09af682c4b8dbe9fbf241198fe92f4e4d52ad730c763fc8e48f9
SSDEEP 24576:sMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:sbb5+Pl6bJTIZ5jdgpq
TLSH
T19E65234A4A6A30C9E4675779C9C9DB00B479BF65DF4636FB84F8543BE6313C9343220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7cdf2d18f23f043f52ba61684c63464db23c82cbf5b98e0d4ab78730bd4793bc
MD5 936593dd554939c9ddccd4672bd613f2
SHA1 b0323aadd897b2f8e96ffea6439d2382066643f8
SHA512 6f0fb0ec6f1736523eb5c5a060d409ec1b16d88eec18de3942ad0b3acdd23f87afb20559b3e052525f9be7405aa37a17d3e4a0d08cbe9634ab03a3cffba89cf9
SSDEEP 24576:xQ9MxZKdcz9dw3dmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:xVKZgb5+Pl6bJTIZ5jdgpW
TLSH
T1FA558C2DABE9058AE177D239D5A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 d19751d68a6a0b05c1e6777e48120aeef659ac257cf8b3f3267971c78ce3c26b
MD5 38f6f2b61313c97b7615a162ac841108
SHA1 213ffb43f4c76119e278a2584734074da9a81c84
SHA512 ada4f9d0bcfa1487e5a142ce8e6a455ff3d812f41a1146222fda9fbada1bfc9a27fc6d4811e1595e8fa30ad2b6a63456ed01984d46931b8d2b833ca52335c250
SSDEEP 24576:fyocwAp2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:aocwAp5b5+Pl6bJTIZ5jdgpz
TLSH
T19D75E00FBB6A40D2E066823CC9858745F773B4309B5267DB55A1C33E8E27AE97D35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6b5711b5d235c1596d7022b044ec0453625796eae8b62a59e89dab33e187c74b
MD5 18474fc87c62ce435491ad184eb936d0
SHA1 f6db8b63b013b6feb8c2a55c07c2b2093cd6fe35
SHA512 eb13f1dd6247ec7d8a66ff613a47674f1eeecd5aaa586fe23a26e7cbb2d445676d60ec486b245553fa5892bfd9d64a046833985819f033f2f80e1657f60b1786
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK5b5+Pl6bJTIZ5jdgp4:U0zuNIrslgJTIZ5Bgp
TLSH
T150A57B3DA2BC00A9D8AAC379C5451365EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d14e053b65c8f34bced3b100f718fbab0edf90ce408e728cd5f2b73f310f3aca
MD5 7f288929ca6bd77e4187b31f992d926c
SHA1 2e05253f5057a8d34f65a246e5fc2dfe5e8620fd
SHA512 6a7a21695df54aec5414c8302dacccdb59813fbba98dd3afff84d392406d74e4caa54aca1ebc17d498040e2d28ed2b23464a426d69df4e87fee5750bb51a5f91
SSDEEP 24576:e1QT7EcpfxR+N5AWAz3ooiYzjMqbXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:zTDxR+N5YzTBjMPb5+Pl6bJTIZ5jdgp6
TLSH
T17055B02EA7F915E9D1BEC6799A23C502FA727821073193CB42A0C17E1E375D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-61-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/400-55-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/400-76-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/400-65-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/464-313-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/464-441-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1252-13-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1252-230-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/1492-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/1492-8-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/1492-31-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/1492-9-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/1496-34-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1496-40-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1496-160-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1496-231-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1516-305-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1516-304-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1648-247-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/1648-312-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/1648-248-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1648-254-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1792-83-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1960-301-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1960-407-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2548-365-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2548-276-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2960-259-0x00000000005F0000-0x0000000000657000-memory.dmp

Download

memory/2960-316-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2960-258-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2960-264-0x00000000005F0000-0x0000000000657000-memory.dmp

Download

memory/2988-427-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-426-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-450-0x000001C290540000-0x000001C292417000-memory.dmp

Download

memory/2988-439-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-440-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-415-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-416-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-417-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-411-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-418-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-419-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-414-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-420-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-421-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-422-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-437-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-423-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-424-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-425-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-438-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-412-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-428-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-429-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-430-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-431-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-413-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-436-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-432-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-433-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-434-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-435-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-410-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/2988-409-0x000001C292FB0000-0x000001C292FC0000-memory.dmp

Download

memory/3140-400-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3140-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3140-271-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3160-408-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3160-309-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3284-240-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3284-308-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3412-278-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3412-403-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3412-284-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3412-286-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3628-326-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3628-449-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3628-447-0x000000000C310000-0x000000000C311000-memory.dmp

Download

memory/3628-446-0x000000000DCF0000-0x000000000DCF8000-memory.dmp

Download

memory/3628-404-0x000000000C320000-0x000000000C328000-memory.dmp

Download

memory/3628-443-0x000000000DC80000-0x000000000DC88000-memory.dmp

Download

memory/3628-366-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3628-382-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3628-398-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3752-297-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3752-406-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3752-290-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3752-291-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4540-442-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4540-318-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4552-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4552-26-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4552-23-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4568-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4568-166-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4568-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4656-268-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4656-320-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4964-74-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4964-68-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4964-167-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4976-445-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4976-323-0x0000000140000000-0x0000000140199000-memory.dmp

Download