81dad0baffcd31b0ffd5a24d37f2de7955b4a1266407eb59e6ac7c5a8f817489

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_4ddb39639eda8e31a87d780b2c86f3d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.9MB
Sample260808-fn1bhs1blc
SHA256 81dad0baffcd31b0ffd5a24d37f2de7955b4a1266407eb59e6ac7c5a8f817489
MD5 4ddb39639eda8e31a87d780b2c86f3d2
SHA1 12e91dfeafa6b8cae4516db88a5a4e7ed36eccd8
SHA512 fac9796a277167dd7e6489b7751d42e0f0fc6538e827510d87f62cd21916ae427987d86ab6edb67219653513461953871de815980d861b0be7918d2cebd2c1ca
SSDEEP 24576:VBYGb8ant3A6nzSpRl11tmlNQ2OnBdFQtP51llPup33kT:MI8KA6U11tmlNQ2ayVup3
TLSH
T11095E00567E904F8E1F7D678C8A34A02F77B7C065671DA4F03A891772F672909E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
3516	alg.exe
1060	DiagnosticsHub.StandardCollector.Service.exe
4592	elevation_service.exe
4252	elevation_service.exe
3524	maintenanceservice.exe
1828	OSE.EXE
572	msdtc.exe
1164	PerceptionSimulationService.exe
4012	perfhost.exe
4384	locator.exe
2852	SensorDataService.exe
2152	snmptrap.exe
2644	spectrum.exe
4664	ssh-agent.exe
4400	TieringEngineService.exe
4924	AgentService.exe
1104	vds.exe
4492	vssvc.exe
2672	wbengine.exe
1780	WmiApSrv.exe
1276	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_4ddb39639eda8e31a87d780b2c86f3d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-08_4ddb39639eda8e31a87d780b2c86f3d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-08_4ddb39639eda8e31a87d780b2c86f3d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_4ddb39639eda8e31a87d780b2c86f3d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_4ddb39639eda8e31a87d780b2c86f3d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8e7345f2a19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc9b904df326dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ffad04df326dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b4ba14df326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd0a224ef326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1060	DiagnosticsHub.StandardCollector.Service.exe
1060	DiagnosticsHub.StandardCollector.Service.exe
1060	DiagnosticsHub.StandardCollector.Service.exe
1060	DiagnosticsHub.StandardCollector.Service.exe
1060	DiagnosticsHub.StandardCollector.Service.exe
1060	DiagnosticsHub.StandardCollector.Service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2032	2026-08-08_4ddb39639eda8e31a87d780b2c86f3d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1060	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4592	elevation_service.exe
Token: SeRestorePrivilege	4400	TieringEngineService.exe
Token: SeManageVolumePrivilege	4400	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4924	AgentService.exe
Token: SeBackupPrivilege	4492	vssvc.exe
Token: SeRestorePrivilege	4492	vssvc.exe
Token: SeAuditPrivilege	4492	vssvc.exe
Token: SeBackupPrivilege	2672	wbengine.exe
Token: SeRestorePrivilege	2672	wbengine.exe
Token: SeSecurityPrivilege	2672	wbengine.exe
Token: 33	1276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeDebugPrivilege	4592	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4288	1276	SearchIndexer.exe	123
PID 1276 wrote to memory of 1460	1276	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_4ddb39639eda8e31a87d780b2c86f3d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_4ddb39639eda8e31a87d780b2c86f3d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3516

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1828

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:572

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4012

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2852

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2152

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2644

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3308

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1104

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4288
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 13327e63b234b0a02687c9a499932506d4d30513c511bff4c7eda8f49a918952
MD5 9587da34cec17d4e63b150277f259b53
SHA1 89db8c19cd2d6323facd2d2cd0a65109ac5e8b63
SHA512 aeeeea3ed94a24493ffe67e63714807ac189f2b014ac3e9e71598a1696496a37934225e5fe0f25ff166d22aa6720f8dcbfc5f74df8ade982a2ce606942864571
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn811tmlNQ2ayVup3:u3q6HjBx11wlNQ1ya
TLSH
T11DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ae70621602ff3fec91026b03d752b6a1cf3f8dce8192817545d66dc1ec740996
MD5 1d9290719258df0cd97bb8520296ff53
SHA1 a06b1a67d7345b494fa84a840da4bbbbac09e084
SHA512 8b457757e12ba79d4ecf5b922cef8901f0945778a32f301c266853ffa1e2bf838054d76b05f15eb38f582f55e5c37f23b1b52f6cdc6f246cb2480921692406d2
SSDEEP 24576:PXYfDtczA3l11tmlNQ2OnBdFQtP51llPup33kT:6tcS11tmlNQ2ayVup3
TLSH
T1F385012837E50CF9EC678278C8B2C511EA7378954764E69B03A499251F333D85F3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c97917caca8657bfb03d2858bf892bfb4ae7246d6bf1a21169173501608358d3
MD5 217be5f35df7573388d451117d38b3cd
SHA1 0d36b4a632a7d972994e257263f4a6aa72ab38e2
SHA512 8b866738208f197da5468d7043de00f1ed8e0bb741626fb153985686448482c514958c1f4d9162132774ee22d09476a48736d584f2a91f0d0b37f99f6c2bb4de
SSDEEP 24576:m0Le5ji0hmx3rMAl11tmlNQ2OnBdFQtP51llPup33kT:mPji0AZ/11tmlNQ2ayVup3
TLSH
T12AA59D25F6748731D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9470141a3d0928d3b9b0ff2f740bbdf3150ada736fab97199ff1a4847cf324e4
MD5 f86a2b79e25b98e90132fcf6e03b8f22
SHA1 05190fa836e037e3538c7cd0b54925e2789a5ebb
SHA512 1b38165c701dcef58c56ac2321bce87521d41d0d6b75ee7cde581fc39dbdb1bcbe825675b1ba883201bc0f956eca3af5f96e26e55282779febfe5d49bc0ec0a4
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWE6q8wyu6l11tmlNQ2OnBdFQtP51llPup33kT:X/ezSC6vUzPvxHjyz11tmlNQ2ayVup3
TLSH
T111756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 544de8d7346a47a64c75cafa396bda6c697ac0ad4eec488bed6a6fc5efdf632b
MD5 ea88a0807429c2d5a8b5668521b008db
SHA1 49eee41a6b35ee664013b545eab7e38239f6b62a
SHA512 003384aa75f6eb247473ec69a407d9eddf800975de06a88b9f35d9926b0cb3cdec231cece9729da2fe02cbf0226b94c2da815aa0fb6500a9725214c7077d157b
SSDEEP 24576:BVbqPb88hv/l+6jl11tmlNQ2OnBdFQtP51llPup33kT:BVO88hXl+411tmlNQ2ayVup3
TLSH
T1A8559E65F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 503274925dd4b68d201b64baaedc92186756c6e0faa456b4506c9710f63c1cc2
MD5 0d3aca76bbdb1ecf577784a2e91bf671
SHA1 84016d174c5a01c12f917485d6eb835d8332cee4
SHA512 3a8dbf84027d3f42b06bb9e51d94110bd07c7d767d35bc776043c3412d6c31326c52c1a9a889a29511d30df7ba9eb3b74c75a16c19a017e9239577995ace2b75
SSDEEP 12288:0XslnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:0Xsl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1A5652308149A0CD5DEA74B7060B78EE1B9DC7CDAEB8A2427870035195A7D77C931F3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9b62cff73d1a843d302beea1de50ce059f7fd8dc52eafe3597de63330401f73d
MD5 9ff0a3a8dc7d5d8c7ee045a67dd92aa7
SHA1 7f791b90a76b1356e81ce0b780851947ebfb0c05
SHA512 8bba92b1f1900aa5f7ed650630d5801db970ca3a24fcee0f1205c1b0a6a90db65449d5c876bcde5b55f1f7e126fef8f7d0fa84b336422168e446c571ff2e8bd7
SSDEEP 24576:1JIUrl11tmlNQ2OnBdFQtP51llPup33kT:1JIUp11tmlNQ2ayVup3
TLSH
T14D85D03BAE28FCD2C27A4DB85691C740E77678714F52A3CBD124820EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 34a5dfb40b5fad8ee6c30878abde3e178a62f12aa62b5a00b39466a6155a020b
MD5 6ac19dc7869e824c7b88006307f5f979
SHA1 3de96894fb5dc0d4023d21b5e5d752478ebafa49
SHA512 246335aaebef686551ef1b8e7c649982c8ccf2698c6950ca777dfbe5504c7e7af9ef33c06e90bc49a2a3ea3b0bb6c806703433bbd201133999aa33ee4aa17a5e
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:CQvGAdlCEL8c/yRNw5Cy11wlNQ1ya
TLSH
T1FB267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 89c40261c339af263d3cfd7106c497c58c2b2cedb063f13c2927210e75132253
MD5 2bdf8ede3774a9bd2c2d4fbc6b3eb99b
SHA1 b78aa97a8aebea3c4bc287572a388b9dd23149ee
SHA512 6f0494bed3c8b353ec92fd63609bb98c84a8934c764c0510f52d4eea0102586e39e843e55b86e2764479620318ecd6176243fc6437382923e374cc882e2644d8
SSDEEP 24576:3UewsAjll11tmlNQ2OnBdFQtP51llPup33kT:Eljv11tmlNQ2ayVup3
TLSH
T1D095E030FE75E436C6BB0DB21B36C716287C79604F5219C3E3A85E9E59342D2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9bc611c51cb675bf114fbcb1318aa756a060fc7477c52215c2ecde8b6bd35acf
MD5 a07f715eb92d33577efb41f4c61d7664
SHA1 65aab956d409fb984f7721e56ad142e636f44aae
SHA512 71976da1eb6d9ebfddfc03cdd3a6837c9c5e8fda66d9f5edaad92d9937f122166e41f8a96123bd1d25da872a63c3855ae251742f623adff2eda787b7997cafd4
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHH11wl2:cUEtQevvqc2W1cpV2EI32rS2
TLSH
T1FA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 025870643eefcdd93fdc2569876af81c0d23227cd9c68ca0bd0e63e41709700f
MD5 34d26802db51ae5931bfb41a5f0003c2
SHA1 80779fb1bd3ebb3467d43b2b76d49f35973454b7
SHA512 88274dd0ed532538339f5c22afe146a2ff94c301dff4bcc99fc207d5bd84d6c556c1a45bcdd74722ff6810a7b85bb7f5d1b6d395956c4c01d29300553cb67034
SSDEEP 49152:rCbRquA/m2yL5zLfFiV+XenmE3/zP11tmlNQ2ayVup3:0oq2VjnmG11wlNQ1ya
TLSH
T1D8D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d03c3260f00201098a9cd48c146e384d44fbb7048812e85eea3bf73bb15a2788
MD5 211b49e9dac4c5b527d68bb732776a44
SHA1 1a307c2f536af035892f62b3c4ba8a0be5d39cbb
SHA512 b8e43657b9ca58b630e184242bada0e1c3ff5cf8edae8c6e4dcae6b817a275ea2ed12df3c840a980bc3348c89175225f0408123a8bd071c18bb07e584989ea7a
SSDEEP 24576:iAhGLJIFoiwtA5l7S53Ol11tmlNQ2OnBdFQtP51llPup33kT:iAMyFoiq5211tmlNQ2ayVup3
TLSH
T1B3359D80E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b8271de0d83a7d88db3833ee7a50481f708a07a79d0480bafaf13423f0cf0239
MD5 1a507644822fbe8c1901b963c7a50333
SHA1 3abad32c58030c3f4bb3deb18f362834cf809624
SHA512 2e77ac1b5fe0ee4409d05156188be349a74e153693ece270f7ddf2006fb7416c9594bc72fa91e185f5109beeef71fe052e510aa345a640e755d6251c2152bd36
SSDEEP 24576:twuSOW5l11tmlNQ2OnBdFQtP51llPup33kT:tw9OK11tmlNQ2ayVup3
TLSH
T11485F14936A50CF9E9A786388597C536F7F6BC022A25D71F0720C61B6F373616E2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 71abe68dc4767431d8e71d1f1806ca94a125380c3bd4c007e0d3d9cf9e37cd76
MD5 bd2e7e03817755137c5e9f6137de922c
SHA1 0c409e5fb1a55a6566b5d100bc79f310b4599d69
SHA512 5ef5edde46e703285425e72fe8934d18e2d92857258969878d65f150402c7a676c0781851a791c4685bc4a855125c3ed4f6ff270d721f0e2bde2487caf7a35f4
SSDEEP 24576:MZuIl11tmlNQ2OnBdFQtP51llPup33kT:O11tmlNQ2ayVup3
TLSH
T11575124822E524F9E5A38778D8F28A45E7B57897677603CF0610122A2F77BD51F3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 10113ed6b4d66ea8e978317551cbeb3ccc45651d68f6d67500e424ce0cebbfee
MD5 a9cd7fccfa0fb0b28329babbfacc37c6
SHA1 1946a4b911b3a805b08f38b26562319650abb69b
SHA512 4bffcdec2bdd6d3e8b01a016c618f3a05a6c56e4ef3cf75b194b1d7cd20d8fbdb63ddac5d6afa10bcc22e050482733aeace228d36f79dab58246ee8a8d722bbe
SSDEEP 98304:QQRQyi36YOcPQLvw2gAf+PN3d11wlNQ1ya:HQyiKayX+PNt11wl2
TLSH
T172667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c9bfd0b90ed0b98cd7d21fe192abddccb9748148cefc266d485eb7a6217c63d2
MD5 1b7107240deb8cc315de5ec76af68500
SHA1 59c0f472db7ec5d96ba6c8defee25a5ab59d52bc
SHA512 404af9db989cfbd15f0ba44bb5180f4187b3ebb6c63f374baf9e45bbd2b9c19b62ab4d99381ecf473371e185ceae346be0c460f3cd28111f85f092f18c2f6aef
SSDEEP 98304:yQRQyi36YOcPQLvw2gAf+PN3d11wlNQ1ya:pQyiKayX+PNt11wl2
TLSH
T1B8667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aaacc44b4bf1cbbb0e0a7cbf72dacdd0b662da291ee85366f12d3d932d781a9e
MD5 853fd8de8403437f928fa8e568ed5cd1
SHA1 c91c7bd3bea895687e3d79b35e7252528b9a2585
SHA512 3a8b082e0ecfef548d2ab4bcfe4e0f197c87ca7a7b4ec055aff6c2e84fd13fd5a1bbf1b4c3fcdc7e60a5044242f54e530f96449002e179b1be46eb81f395c4a2
SSDEEP 49152:u68Qg55nhheWu7PNU3//11tmlNQ2ayVup3:8thWRc//11wlNQ1ya
TLSH
T1B9B54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 539da35e6143b7d4593d915a98ae87f2476351ed6fbdb7f92f2d6ae6b7c517d7
MD5 f3c25d704b71e46665db51c1d5dbc491
SHA1 119749801c9bd9ba9950ec92003b804499a15c3f
SHA512 6fe47cbf2072a6b65c3c105ed5dcac8281f6ea18edcfdc61409a378f89d03166e3a7826974959bb1ee8fa9918efb77130cd38f3a58d8a8aa2c1b21305dee6e78
SSDEEP 98304:ay5112gYy5azzVvL69nLKnhZw11wlNQ1ya:DLIHmWh+11wl2
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 96359a7e34f41a9f5bd2fd9b04bdc046f6367ce873ea06e109593e62eec69773
MD5 5956a5bfda73c619b5637784a39977fb
SHA1 63ea3d5224f13cf869b8b8bc15372d83a69ae2a8
SHA512 d32600cf3bea3a53c91adadd345a5c546f95ada3bdabd02fd90b0e561a3c27c6bd5eb129f65a7169395e1a7bfa5b7d413038ce2ccd65644cf89c790eff8cae33
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gll11tmlNQ2ayVup3:Uu6JmVxd2dl11wlNQ1ya
TLSH
T168D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 26fba526e60c6b455a81f6101c9aeb731c3c21b31f36978554086844dfa579b4
MD5 cefb9f6aaefe79b628b8910696c565ca
SHA1 7d3c23c1e055e3c3512e8353d5a74e5d5ff94982
SHA512 f24e387bcdbc16e590869483769875cea691c645d8fd8d25c8ef83ae420428050c9c2a5a2ed69bd548ab5be7f8426a0abfde1583ba16cceb8d2e7756d419193b
SSDEEP 49152:s1hpsNoJpF1A6UU44CwH7R4xJ11tmlNQ2ayVup3:smifPbRG11wlNQ1ya
TLSH
T1DCB5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ecb59e162cba1d33c730e3dea77e0be1d0829c148fbf5a16c80d2a8fd0c7eaf4
MD5 14ea853e82d68c459ec5af1ad92211bb
SHA1 8b9e82556340a3410d8aa048971fd43fa6f54960
SHA512 13a6e092be7413ba3460e332153c7ddeeb77b8b111ddad9396628b600e9febe0123c70c237ec51ba1b86176398a1aabd403510cbc944f289b61ad1092be3e0c1
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHqs11tmlNQ2ayVup3:N5dKTi61s11wlNQ1ya
TLSH
T1E6C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4fb38b057e00999bc8f54969c81178db8a8eff9ad90577b7f76a78bf9cd06c7b
MD5 2e11603846fd072e7e2704f20679975a
SHA1 7d042e8896b3f19adc594c8e854f1f38378cd501
SHA512 36af3415e6174ee0039a978e417befddbfb4a5b9d231cd3a55270bee751cf72c72d0afe856b9c1e76bc1554715c69b0e1c692294a22ae962b21183f0997c2eb3
SSDEEP 49152:1htSn8EApI0figngiDn0AP5wV11tmlNQ2ayVup3:EX2iyphq11wlNQ1ya
TLSH
T18795BE13F2D900E8D05ED174C7568632EA62BC160B39BAEF0A50B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 a1c1b2f2617df542a17696f2eb17f079185b5bc05e0c30ae768894fb299f0fac
MD5 aeb84a1b5d0852c68873e6393c3ef1c6
SHA1 c88f795351ffb37634b1c34f4799db6de4f94cff
SHA512 58c41a769cb4aa7b6690a3c6776d54cdec867a2ff2060f92690904820d7437696e70ca2b59d36da18dbf30b8cb373e5c3c313f07ec76a9a7c28d754119a0bbbb
SSDEEP 12288:I0lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:I0l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1C965230814AB0CD9D8574BB090B38AD1A9DC7DDBFB5B2067570030156BBE7BD231E6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 31978182aba65b8b6dd5d1bf85f108f7bddf130ee0ca57c4632e76e43a37cb3c
MD5 d8718400cb7953598659bc43b48909ea
SHA1 dd6f48b7c03d43dec1cda8fdf12e849a32a53cee
SHA512 3222119afc61153c2f5a49ecca1e5faa456a1e824881f9daffd836ffbe864702b167a35d9ae2d68b9c388a2e48b93c8d41a4deaab9ac45ed5105a89c7c6b7bb1
SSDEEP 12288:fRlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:fRl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T10F65230824AB0CD9D8574BB090B38AD0A9DC7DDBFB5B20675B00301567B97BD231E6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 e00618a590bb2b448c8b3d121d99ef447ae1e00dc5390efaf897b2507924c3da
MD5 962db1a1d708652e0e107183e66e1b23
SHA1 82b65f8ff2f13c349671f808832041cb8dee2df9
SHA512 98d83e6cfe96cfda70fed95a6ce86b6626c3363035083d8aa1dc0b151f3e59b65eea2fb849075c2412884998d70e9e8f45304928405820fd867409686e76d54f
SSDEEP 12288:jTlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:jTl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T15E65230814AB0CD9D8574BB090734AD1A8DC7DDBFB5B20679B0030156BBE7BD235E6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 07e6820a1fb67cf9b6d510d3764ceda4917de70a79f275bc0220b3f76ce23689
MD5 4fdb916ff42616c305bb27182b02d4ac
SHA1 ec1911d14ac014ce5c9c2638c9c58d7bc448876c
SHA512 228aa216c59dde7f3750f23bffd3ea5fee9afe029484f23734a955fb8e8848dd8176abf65a6f0eb9050055862e5c4f3766f0381a01d2c196d38271a2a7235b5b
SSDEEP 12288:mVulnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Nl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1CA75230425AA08D5D8A7C770D0738A91F6FC7CDAF72720AF9B0024191F757A8673D7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 a3148acd3c75b86cb077be4eb3d882956165a2899e51de4eb0057d90646d37e3
MD5 87a384cbb430276d96af504d2e341dae
SHA1 e830fcb81c840aafdc8f6b9a0336d8b886f8aa41
SHA512 4d5c2879111bbad0326fdc27c304d2d0c05ca50ac6eafe8ef4520c7d7383eade039ceb421ae76d726ce8c0d3800acaea7fa88cfe1c2b403569d60074c60e068b
SSDEEP 12288:+mlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:+ml11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18C65230824AB0CD9D8574BB090734AD0A8DC7DDBFB5B20679B0430156BBE77D231E6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 7353a3d22d990a56790d87131d30ee2ab10f64247ce511ad6e61cebfffa25c84
MD5 94b2b27540bdd02e2057bf87d3398006
SHA1 4579224dc3344536e8a90de264b700ea676797f0
SHA512 34f9328f709c361de1d2c41976e7d0cb3badcb26e55492d01281b94f20c3eb8110ed301dd3216f814100ca631534e92afd57f20042187976447ad6e990a1c392
SSDEEP 12288:8NlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:8Nl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1D665230824AB0CD9D8578BB090B38AD4A9DC7DDBFB5B20675B00301567B977D231E6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 014ef2f0b17939530b5a3a2a0aa23ef9ba38f39b0a304d3c0dcf037eddbc4e49
MD5 2278c1a822a80a60c6c3a59104cbea86
SHA1 a3134cc03c7c0ca20b637009604668e031c6bb02
SHA512 9dc6d6e91464b7173b846c9172b1d1fcaf1010ae66f6a0b41c9db7123b08af194967176386d60da6e41a7cf9d4206ba3ce021367cf05f529c7bf7deae860be4f
SSDEEP 12288:5plnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:5pl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T19A65230814A70CD9D8574BB090638AE4A9DC7DDBFB9B20679B00301567BD77D231E6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 bb1fecf9ecb3cd1c0de7094eb53388a511c9c5f7c584a227bd0690682dec0a90
MD5 d10d223149b6081028b4f41b978c4c44
SHA1 730e4259a2ecd6319ed0d0b30edc86483069af68
SHA512 5a76950ca466802c9fb5ea542e34afddbd26acfb1d3d68643f8ace2f868f9d021eab06bb398b179451474b4df4656c58715c48b0b0f761835b22d5581e473bd8
SSDEEP 24576:jZMjzFVSOxl11tmlNQ2OnBdFQtP51llPup33kT:jZMjzfn11tmlNQ2ayVup3
TLSH
T1DA85029473901CF8EC678239C8668906E6F27C5A5B70C51F03A436275F773A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 4936da6418c370e96e3a3b4131698899449b485f48f1f4be33d65c8d76305089
MD5 44a42d867b6dc10cecb3e02d690b08e6
SHA1 4c8dc9483d6fd673fb4f8840b922f9d95c1ffe1a
SHA512 828d212896792d69a7801fc58b792c343828e9f8c5ea29553656563313226b89aaae9df2ce68ecbb92b95c825be0eecbf12df8798a4701579ccc4034ea291a33
SSDEEP 12288:LYlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:LYl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T19B65230824AB0CD9D8574BB090738AD0A9DC7DDBFB5B20679B0430156BBD76D231E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 5ae1f1759dc5dbb71b5c9b1e305640d35290d39d87d99141206bf798231bea4a
MD5 e063a5107648543af09da91d2f363637
SHA1 2fad75da46d6e56a1f9c0c084dccd257cce26567
SHA512 42bfd88d18400d2b87b63ea1b0e13542fb44976abcfb9eb5099329e5e878d4c110c9c0f0b020a8f793931fed5f51e5d02c62d161f8ad5598aac51457ce62ef7a
SSDEEP 12288:38lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:38l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T12A65230824AB0CD9D8574BB090B38AD0A9DC7DDBFB5B20679B00301567BD77D231E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2862df89f1c8cc21b1bb3d797e122a2a2165af83e4ebbda6350367621bcb9e70
MD5 58f404b4e06a9147d6e0d8a1e860dc03
SHA1 8543c9ddc6af4df5c526cf6348eec6cb70bee7ec
SHA512 2ad054e3b3ed9df057f175087d375f1a44f2343fbc21300350a9149271ec86207b2a9ec2a560a29eb3ff9b42596ce230258a35f3dbd03fcb4c622728af39eac4
SSDEEP 24576:Hzy1l11tmlNQ2OnBdFQtP51llPup33kT:Hq11tmlNQ2ayVup3
TLSH
T13D75020732A630F9D4778234C8A20A42F7B9B8765B2559AF1710163A2F377E45F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 5c759f0e77c42715143c0472c15f5bc696e92c06e27b597b799281910e29e9a6
MD5 6e36df3271e44d6f9d446585a41d6789
SHA1 1821a645cf1eaf57366a8190dcd96216d0e570aa
SHA512 f8d036567ced6a1224b969a3325bfdd3cd11215a709f97fd66c97bacaf09163386044fca5004c04e00b7ae84fdea083260bdf464975c5ab3ff388ec78eece733
SSDEEP 12288:lYlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:lYl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18265230814AB0CD9D8574BB090738AD0A9DC7DDFFB9B20679B0430156BBD76D231E6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 28fb9af412ff2bdb3b8316f51622dd031c0b699657a15c66ed48bebd149428a9
MD5 a0891928f52cfdcd738fe37e90e9f15c
SHA1 5914f1c1b13a6b10f845658c09acbfb60e27492e
SHA512 03ed9c5b4e038d44624eead735d22d31c4fc6c042e103f049a1787b3f709c1b12d9882f2462ea48bce969bc5da4352a416d22b3e8261229123fdefae21c8c2b1
SSDEEP 12288:7YlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:7Yl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1BC65230824A70CD9D8574BB090638AD4A9DC7DDFFB9B20679B0430156BBD77D231E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 77d0ed9079f2edbed46169d1a10bcf68657011b1cc940e1dfce32c86885ab777
MD5 cdf4485ecd75c219aa1568fb504d51cb
SHA1 4f1529e9e5478c0f01d1ad198779847a55973838
SHA512 52928a73f41e580e4a80e874a0af590ebcbf87ab353640298ce62f8b6c981ba6943edc2751bb7837c076972a36c8c3811a936bf6818c0296cb886e4bf7395faf
SSDEEP 24576:yzy1l11tmlNQ2OnBdFQtP51llPup33kT:yq11tmlNQ2ayVup3
TLSH
T1D275020732A630F9D4778234C8A20A42F7B9B8765B2559AF1710163A2F377E45F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 dcd7426296fd7410addd0132ca700cd80b504b1ef7f02b4156f0a466aa0780ec
MD5 c29dca4c54e8518a880af84f2de9c9ad
SHA1 fd2a051fe576aa67347829bb103bdbfd54f17c7f
SHA512 d3539b20555e6a036af8aa53e32a8f020722f26bb949986a046667eb1cf824314f081cff150209b1a2d69ec6df74794ea374d21eaa496138af2b77d3275909ba
SSDEEP 24576:sTYaLl3z0zDDl11tmlNQ2OnBdFQtP51llPup33kT:sTvLljC11tmlNQ2ayVup3
TLSH
T19885029473901CF8EC67823AC8668956D6F27C5A4770C51F03A4362B5F373A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 499814ca0815cc6e39f7c7076f87e7408e947f9bda49ad57aa61592707317b9c
MD5 d55b83ef6b229b2a5b331eb99fc631c4
SHA1 aa17701af3ca9c4fe10229e1e5ad36b3fe8d4a3a
SHA512 af7eea45ea89f4c301d58dbf61e016f9c14dac23e22bab7569411d4c7a30635467eb198e072fae1c43a52dd78e22ea883dc14be7d224410eb4efc98b6646623c
SSDEEP 24576:x35d9CHKy7GZ/l11tmlNQ2OnBdFQtP51llPup33kT:h5d9CHKyan11tmlNQ2ayVup3
TLSH
T1FD95CF90B3E414E8F0B78A35C9764511DAB67C9A5B71DE8F03A4251A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 852f38be869bc9a79e1564f60843cc71e8ae12b3a385278cea0116b2964c1213
MD5 e384ef5f4ee58c2921bdaa2ada52c9e6
SHA1 2001a56ef8414adf6994184918f9a0f7f998357f
SHA512 184e978dc7c9b5f39cfdc0ded82ae9b6afa2d499b27ea54309d419fa1699f5b1fd626bc7b2c5aa9b60ec48ad92165b683e43b929e3a3528f56732b6412efd536
SSDEEP 12288:uzlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:uzl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18965230814AB0CD9D8574BB090738AD0A8DC7DDBFB5B20679B0430156BBD77D231E6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 c8463a6b215c4b3b8f7d40a7a3ee81723654796df9ee8c7e14f7bea706e77d9e
MD5 e77d1e837c0d9004349d17e50b920d04
SHA1 1150ac7715370ae388d89c4242396879c34008b3
SHA512 5aedab4c05c218da9074648f58bb8bd8483874d08126563e0aa961d81d61e4368f290e6627a477e2042787f3ef94e976b1df432be4e280fb00070221e546c026
SSDEEP 12288:pVlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:pVl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T10B65230814A70CD9D8578BB090B78AD1A9DC7DDBFB5B20679B0030156BBD77D231E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 d22906cff3a50de4c3672c688e3d15ba7aaacbece1fba7db74e207aafaa6aba7
MD5 d55f46eb315a6ecfba64075e29aa762d
SHA1 5f3e6e44de1672a9dcd340cb15bd4612c5470ee7
SHA512 4750075b99c92a1c72e3429cfbbe15d09517aaa5e0e96780eb712ea6403d8c243537914e69e6c05afbb631eaceefaab8117e4a2a5a824e2b0ab8c05abd955688
SSDEEP 12288:bSlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:bSl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1C565230824AB0CD9D8574BB090634AD4A8DC7DDBFB9B20679B0130156BBD77D231E6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 707095dd355291209f54a82121465842462e247e9ad1414eaffadfd418d4719f
MD5 8ff3d10da1b12c32b1656a4d64d71ee9
SHA1 3a8b1494cefa136900a5188c5ede78fb96140001
SHA512 340c53ade0c4d6fbf71c5b09181de9a8826b4534ce567880e92bd418d025962d3e15949b49582ff0d61b4e6f802d9285fc1de1f0e307e810054c68eaa83d53c1
SSDEEP 12288:3jsfIlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:iIl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T181750108D29801E8C06F5274C7624A80F37B7C6697E292CB57C0F53E1F7A6A45EEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 a248e992fe1486e059e0eb32152928aec8b4b6e486f02faa95d38ccc16d9b784
MD5 42435f0499d5796ee14d7a52f57bf43a
SHA1 870bb9d8885e1aae7906eba88e0933e583b30319
SHA512 8a353ec68e8585e13fcd8cce58d4e8afaf9929623bf06a54bf6a9533296a6772bc9897d5516f830b2a8025a47305404ece29082e66d7a53351fb69e06294bd0e
SSDEEP 12288:aalnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:aal11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T10E65230811AE0CDAE8B78B705073CAB0759C7DAAFF5A1057A7003119267DBB95B2E35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b642a019c54fc3da86024bb5c4024d82f543aa80f5f9532b733ad203185ca0b4
MD5 24287ab363517a5fc25077bfc6513a40
SHA1 8d4cca4dbaf7fe6a1935af3edf61ae6ec1609fe1
SHA512 e48132546a97227eea2ef35c311e0700516471d5ccdc6048cd4036210dccbd61bdd20efe8f4211cd34706c233f3e11d6ebc97f19b550ab09fac07689525adfab
SSDEEP 49152:0a0h2GEkuAe73q3pp46zwwQU11tmlNQ2ayVup3:0a0hNYG4Jw111wlNQ1ya
TLSH
T12285AE1D67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 e64135fca111b3f5e8a8b5f7eb81518756746d654a773058147dfa1fea53439d
MD5 5f3dfa40f11bb50d1ee0efbadcb4591c
SHA1 7d0d57ba16d672f6109d13e09d80641048ed5eea
SHA512 87fce53a3f7486ee463748f169d2b1238630224083bf225721f350d08a952e73153c312e7ff02c460e090b44c02c8917f64c474624115ce7f1792b64e99e5779
SSDEEP 24576:JhbHjPOl11tmlNQ2OnBdFQtP51llPup33kT:JhbHje11tmlNQ2ayVup3
TLSH
T11975123C16AD14D9E572D27891A28646D774BC66271263EF1381413E0F3BFE81E3AF92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 e2f4b6f86121fd0b176106301daf1a051b5f9ed5da031ec2cbd1676b297bf711
MD5 36937f8283af9d4b5367e16b2a5b4e59
SHA1 8e5aac33852ce2945be23593fc90c66ce91b2fb6
SHA512 a1d387c7cecb6064730dded2135bee3919fa9ca87f87275648b26789866d8c2709e69828ce54c5feafcd6b00cab633af8d136e5410b7bdd2691bd9aff2b6130f
SSDEEP 12288:3ulnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:3ul11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1D9652308145B0CD9D8A78BB050738AA4B5DC7D9ABB5B20E757003119677E7FD233E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 86f3d0a0e62606fa28f907412f659daf1ce0751217904c18bea5fabff6481352
MD5 31c437bc159b6dc4d1833cef05616b2c
SHA1 9f79f426db8650e20514e3b97a0fa0b884024941
SHA512 99497d142dc3ebee88d6ef2935601492e6153f671886b7e9976bd50a65c8a8078b0cfca5fc79bbb75fc62179cedbf438ac90fbb0908993e6338499e8f50ab702
SSDEEP 24576:9cL3UThl11tmlNQ2OnBdFQtP51llPup33kT:9cL3Uv11tmlNQ2ayVup3
TLSH
T13395F114E6A504F9E86BC23CC8B38A16E2B2789D1764E6DF03684A651F237E54F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 04ca2a47f20387c11d2d6aa143ec25978bd04c5338b1ba6415a2a7d38672d250
MD5 d942448e33c5dc64123adb3762be5d17
SHA1 12a672e6067bce99d35b77255932093b1de3b9e3
SHA512 853a714eae68453f0b7e4dbbf8ba9afd205d1b25c79b864b24182d847edf93d145bb6684d11bc584f23e98bd34cfdc122da5eaf40d10d2f4639daa5b2bc184ed
SSDEEP 12288:jpFtvOFlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:5OFl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T14B75021832ED14E5D476923885938349E3B5B8A6172213EF0740417E1FB7FF86D3AB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f5de9967b8241d36efe22439014f7b67ed367753a7fa0f9b17144b75c445e2de
MD5 e8de2200bdc852d63ba62c27032948ee
SHA1 3eb29f1450c9f8fb6cb0bb459f275d937aeb9b6a
SHA512 e56676731d5202fca574df710c4cc507a6afb752804bf35163f4259f6fcee86a101ce3a989253e0886887ac75580a3473f4a99421efbd3f470fd1e5c60fc8b91
SSDEEP 24576:M7NM9YqZqmWMUkPjZM48Mv6bEhsKl11tmlNQ2OnBdFQtP51llPup33kT:M7cBWMpPjN8DbEhJ11tmlNQ2ayVup3
TLSH
T1FB659E2D6BEC81E5D477C13DC9A28645F6F1B4611B318ACB1252833E6F37AE44E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ad3deb1f286ffefa5d1359e91c9581d863804519e96de33487eea578a887b62e
MD5 756f41f5e58774adf4cbe8f03e51cd4f
SHA1 5a8b381335c5f9b4ad03ff9dd3531bbbe7d82eb9
SHA512 3fefa4d2827545e35592a010012c138acfdec64080335b99beed51f8f2be181d47481c2553e96e5edd29d887154efce822461e2469f1397f5f0aad4bed0c0b15
SSDEEP 49152:SF2YuHNETovAvNYf8kmS11tmlNQ2ayVup3:b6BCf8kP11wlNQ1ya
TLSH
T1F3857E2927ED80A4E0BBD27D45B7D286FAB2B8551B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b474ce97f7aac6584fdf4212c767beade3b2fb5afa8f00a41e7d379c86d80c6a
MD5 b866ca27906d013bb61618964208e9e2
SHA1 5975b489f9444075aceb154d1294671c39cef0c4
SHA512 c2e5efd6dfeda520391b0a1ab50fc367f71a3108b17ba6d9c128400d5cf2069eff0f3202dee7be9eb8d15c1afee9df9acfdf20ede6a0985a87e0600196c88743
SSDEEP 24576:XAFs06+Omlf3NXEbToJl11tmlNQ2OnBdFQtP51llPup33kT:wFs060lVXu011tmlNQ2ayVup3
TLSH
T15E65AF2F62EC00D5D07ED17D8997C91AF6B1746707256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 8d8867230cd8f39a5cb0c761b1705c5cbf9ee4249b6e804921547937338b6ec7
MD5 bc470d9a5c97a85bfc238022211cf72c
SHA1 13408ea47ab35a2d1f17e071cdeaf6905e1fbd1c
SHA512 1e93ba6e20f909e38404c35b1433672ca90d7bb7a70fffd8f83444c3e7ad90795ada5044e9a4afa0c4eee6e88eb6e9542d13d9355b5f62ae653015953cf1bcb1
SSDEEP 24576:+JnJ5D3WeQl11tmlNQ2OnBdFQtP51llPup33kT:+JnJ5DGe011tmlNQ2ayVup3
TLSH
T18E85D02CD2A810E8D4B7C3B4815A1B95FEB1387D2F2269C72864D5353F12FE09A79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 fd5d59d08cd57429b7fc36acd5508f44c5530c04328220a119126f3420a8829e
MD5 55efc4611f7740e6067778114c58c3c7
SHA1 a92b2158d3746a9d26011664dd77e2bfdc8931d3
SHA512 2bfbe8be757af2a97e03fcdd4408018aefbc14dbcec12317ebe565ea2e60830e81974cefaf8868096e4f234e9341dfe451874c4429939837c8303e1ee2b8c706
SSDEEP 49152:Ug06DIKdwc+eQnSt65aVu11tmlNQ2ayVup3:FA11wlNQ1ya
TLSH
T1B0956C05BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 799ec4da7ba43a97fbe37226845fa67fbc2bedf68511699aee91ef09ab2f58f1
MD5 208276f8255a6bd3903feaf9d5113c04
SHA1 ceca8c8e7096cc5ddf21e2d917de4d905ccd00ff
SHA512 82831703cf460ae1fa31ca601b6f55a3dff36a1857bbf93909cb98da8944148088a1d91421739f11258958e47631543244c9e9127afeb36254bd7e49e19f39c1
SSDEEP 12288:mEP3R2llnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:l2ll11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1C375121C26AD20E9D467827880A28644E3B5F0B56B5327EF1750813E4F7BAF92F3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 62e54b79e0f4bdc5c64e40d2a2d73ddf456bc0a8cf91f00cdba6e0974cd1187d
MD5 490908c889573553944866b2ff967d61
SHA1 49fd1469f231cc8c60b8aa1c3feafdb1468fe6bb
SHA512 b48579794672098338ebfe0472a28a479adfbaf98d0e07dc15f239563c78406b36bf8d8711338a946d9941805844d741704573ac7217bd97f97f78ff811d2f7c
SSDEEP 24576:FIy7l11tmlNQ2OnBdFQtP51llPup33kT:FIE11tmlNQ2ayVup3
TLSH
T10D752308239818D4D9B74734957382E09E78BC21AF2611EF5240F63E6F37BE46A39B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 8f367bf73958d6afe7af94f656f491331878bbb232af5bc0d548a7e6e8724b9c
MD5 1b1daf21c90a094de32adbae9dd9ab43
SHA1 32dca6686b98a13bda7a44f3683c8651b4cd61f1
SHA512 9af2b19c5f364ba0f062a182540049c02642eb347f27f8ed5e86abdc16fa3fd9f44eb5c33b000bf7b5a43daa6d307df65452559c7c41ac1c4623090ed23947e0
SSDEEP 12288:vAVlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:YVl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1DD65230C10A72CD9DC634BB050774E90A5EC78AABB5A30FF560071355B7A7E9233EA97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4f2902a9f6e788a97685717f48119b38d47ea3366901f5716db9a8d0f115cd39
MD5 38bd8928d1856fa2d9432df507dcc685
SHA1 b67084eddd7b58266a8abe68a932c1460905239c
SHA512 3deead0eabbaa03b0bff44b25acf9b01191c9b2ee236493bff550bfb2b7ac776109bd935817615199a0f553323f2a0eb4a803bb336004a8e0e4c4322208be306
SSDEEP 24576:jQ9MxZKdcz9dw3yl11tmlNQ2OnBdFQtP51llPup33kT:jVKZ611tmlNQ2ayVup3
TLSH
T11B558D2DABE909DAE177C27594A240C3A673B4311B35D6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 820fb0d48df145e95e534058e60f7bbc6e41d0d2c6cb18a0206a2ad18dcee013
MD5 0a746b2183e09e0055c1c896cca1891b
SHA1 d62ae4f594cc9b7cc6e6e50feb986e5eafdb016c
SHA512 874bde2ccddefbb3ea24445561bc260d762f9bb84fedbf76b33462a5131a1a75a9a644ac0d04efc0065cf25fd89ac8476062e5cbab4833ba7a0ca65b8b34d1be
SSDEEP 24576:5yoceApfl11tmlNQ2OnBdFQtP51llPup33kT:UoceApd11tmlNQ2ayVup3
TLSH
T1A385E01F776A00E2E076823888868745E7B3B0715B6213DB5681C33D4F77AE97E39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5a1669b7b2c60e148ec7b7c6f8d93df4886efe5ab59a5452b5a31d7de8e5ecb5
MD5 fb472d2e08c11e2384d491af710d6f12
SHA1 89ca5a4d69a4455af838892efd343d92bf55e2ab
SHA512 8130cb37e062c8864c76668d51690a967e705e7cd395ae91fd2ebb035aa73a5e56939b77873c20f1308774fecc9ba96650aa944b3e944b04073008c7c977d32e
SSDEEP 49152:WWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKd11tmlNQ2ayVup3:g0zuNI711wlNQ1ya
TLSH
T152A57B3DA2BC00A8D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 199d72aae2f29fba00df7dcccdff74a9d8a6f18c50ccfb0f803321d9e3571257
MD5 730f84d7a35574712c08c94b0ca33ee1
SHA1 31187adaeafbcd1b01136cb378e162cf95643fd5
SHA512 d4bb91a6d64be3f28166cf9b8625685871b288ddb159e8c9e0aad82af0d4203394936915fe10ef561bc989f15c4e6975815edb9c2c5af05a93efbf1d2580be5c
SSDEEP 24576:W1QT7EcpfxR+N5AWAz3ooiYtjMqbll11tmlNQ2OnBdFQtP51llPup33kT:7TDxR+N5YzTfjMY11tmlNQ2ayVup3
TLSH
T1D855B02E67F905E9D1BE86789A23C512FA727821033193CB4260C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 211540ae32b1096f11153ce227d0f6189f1d89aa7b986090744cc7147c6860f4
MD5 d70d7518429041e9da15d8f1489ef9ee
SHA1 51d267a65949926ac6ef242a93fb6f9ab04b8ef4
SHA512 041ca4f75d7b2cc5763ea09c5c72363580bab08be9cf46858ad0730a37070b47ded3b33cd0cced87c75805ed89fb41b249b199cc213ed7479d6f946aebea15bd
SSDEEP 24576:83YgnJcRTk4yti+R5dBR/2l11tmlNQ2OnBdFQtP51llPup33kT:8IgnaTk46pBR/O11tmlNQ2ayVup3
TLSH
T13145BF2DF2B910B9D8A6D236450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-308-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/572-240-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1060-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1060-24-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/1060-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1104-309-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1104-406-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1164-312-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/1164-244-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/1164-251-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1164-245-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1276-334-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1276-410-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1276-343-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1276-359-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1276-397-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1460-444-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-434-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-452-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-451-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-450-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-425-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-429-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-426-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-427-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-428-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-449-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-448-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-447-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-446-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-445-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-418-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-422-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-413-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-420-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-421-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-443-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-442-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-415-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-423-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-430-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-441-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-440-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-417-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-416-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-439-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-438-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-437-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-436-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-435-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-419-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-433-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-432-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-431-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-414-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1460-424-0x000001BC510B0000-0x000001BC510C0000-memory.dmp

Download

memory/1780-409-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1780-321-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1828-71-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1828-72-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/1828-78-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/1828-232-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2032-31-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2032-2-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2032-0-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2032-7-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2032-27-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2152-399-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2152-275-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2644-403-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2644-278-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2644-279-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2644-285-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2672-408-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2672-317-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2852-271-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2852-400-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2852-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3516-12-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3516-215-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3524-66-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3524-64-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3524-62-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3524-56-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3524-68-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/4012-316-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4012-255-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4012-264-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/4012-259-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/4252-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4252-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4252-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4252-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4384-268-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4384-320-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4400-405-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4400-301-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4492-407-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4492-313-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4592-230-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4592-40-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4592-34-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4592-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4664-290-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4664-404-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4664-297-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4664-291-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4924-306-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4924-304-0x0000000140000000-0x00000001401C0000-memory.dmp

Download