656904de9a23e1648e570c04fe6115686423b3dec4502bc14058d261b8069063

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b3b7bba48bf6775f704f7cf36fefd210_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
Size 2.1MB
Sample260808-lsdk7sdj3s
SHA256 656904de9a23e1648e570c04fe6115686423b3dec4502bc14058d261b8069063
MD5 b3b7bba48bf6775f704f7cf36fefd210
SHA1 ae4bb4f29373e99df95d9d78ca5a7af250af901b
SHA512 12dafbaf73ece576a2071411c7f9bb741d772f2eb033a7997c5dc1f481d66962adab67f062a3b851999fd0401b44ed9a78ffb10deecc3f307003f3678c7cf284
SSDEEP 49152:YKSyBpFTN01vp2rjzGrkLNiXicJFFRGNzj3:Y9EN01vcrjK47wRGpj3
TLSH
T19DA505377297D0D4C41D90B4CF160AF195A17CA9C7E59BDB01CC7E24BB32AE07ABA609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3068	alg.exe
4756	DiagnosticsHub.StandardCollector.Service.exe
412	fxssvc.exe
2988	elevation_service.exe
1720	elevation_service.exe
1560	maintenanceservice.exe
4772	OSE.EXE
1656	msdtc.exe
5036	PerceptionSimulationService.exe
1716	perfhost.exe
1960	locator.exe
2916	SensorDataService.exe
3300	snmptrap.exe
4128	spectrum.exe
4576	ssh-agent.exe
376	TieringEngineService.exe
3520	AgentService.exe
1896	vds.exe
880	vssvc.exe
2220	wbengine.exe
3388	WmiApSrv.exe
456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_b3b7bba48bf6775f704f7cf36fefd210_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_b3b7bba48bf6775f704f7cf36fefd210_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2feac8a0f77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-08_b3b7bba48bf6775f704f7cf36fefd210_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_b3b7bba48bf6775f704f7cf36fefd210_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-08_b3b7bba48bf6775f704f7cf36fefd210_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002bf38d2b1b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fbc352b1b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3b4ef2b1b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078011d2c1b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c2ae62b1b27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054ec282c1b27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000161a952b1b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e135942c1b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e466c22b1b27dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4756	DiagnosticsHub.StandardCollector.Service.exe
4756	DiagnosticsHub.StandardCollector.Service.exe
4756	DiagnosticsHub.StandardCollector.Service.exe
4756	DiagnosticsHub.StandardCollector.Service.exe
4756	DiagnosticsHub.StandardCollector.Service.exe
4756	DiagnosticsHub.StandardCollector.Service.exe
2988	elevation_service.exe
2988	elevation_service.exe
2988	elevation_service.exe
2988	elevation_service.exe
2988	elevation_service.exe
2988	elevation_service.exe
2988	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4996	2026-08-08_b3b7bba48bf6775f704f7cf36fefd210_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	412	fxssvc.exe
Token: SeDebugPrivilege	4756	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2988	elevation_service.exe
Token: SeRestorePrivilege	376	TieringEngineService.exe
Token: SeManageVolumePrivilege	376	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3520	AgentService.exe
Token: SeBackupPrivilege	880	vssvc.exe
Token: SeRestorePrivilege	880	vssvc.exe
Token: SeAuditPrivilege	880	vssvc.exe
Token: SeBackupPrivilege	2220	wbengine.exe
Token: SeRestorePrivilege	2220	wbengine.exe
Token: SeSecurityPrivilege	2220	wbengine.exe
Token: 33	456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeDebugPrivilege	2988	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1104	456	SearchIndexer.exe	123
PID 456 wrote to memory of 2304	456	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b3b7bba48bf6775f704f7cf36fefd210_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b3b7bba48bf6775f704f7cf36fefd210_akira_cobalt-strike_icedid_njrat_rusty-stealer_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3068

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3504

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1720

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1716

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2916

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4128

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:808

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:376

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3388

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1104
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 af1b1726d587087f8cb2eecf5f4634c5c5fc32eb9e7b2eac2b73f5cfc4559231
MD5 d058a5233c894e14c0774c9347987a6d
SHA1 0bed3108992c97cffe946501e9b9fce9e683d5c1
SHA512 09f5c2228dc7415cc684b7551511155814077a00b73fef611ee2f96c4eb9f59ca9bd858b4da087e3e9cab942f3391fe41d6f3764194bc9b58a02c2313204b51e
SSDEEP 49152:ib+632BuPkFKRrdE6ohdstBhuXjfS4LWxn5LNiXicJFFRGNzj3:E3q6mjBy7wRGpj3
TLSH
T183D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 eb843eca3e7c479ac427cab79ae44a498f11624d021822601e9ef04ce841777c
MD5 1d1ad3d279e8e2376d6c27493a649799
SHA1 dd74a904c479a09d03b16c884d9fbd9c2329b115
SHA512 b37601b1f24e0c2544a79cec98d2060dbedef9318b3221f5a56292cf9909dc5587f4f2db28f9b8b1b52159772ee189aa6c06255418fb9490be878f0f5e2c5a47
SSDEEP 24576:IXYfDtczAO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ftcvLNiXicJFFRGNzj3
TLSH
T1D775012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 58d8ba2d1e981bf3958b7c9b9aa5fb576b312d7e80d3fb1362077ba197208af9
MD5 8058cdbb516219a708e62288fd5d04b0
SHA1 6f640f2f37ffebd975390749799533935ad1eaf3
SHA512 4fb9b82a00472f61020815c16737ae3f7cfb8e245be3d2ef3fa4cfd3abf5e6511b60f8c767d69a92d933cd3597624f5f368119f851b43e25eeff70ed7bd5ccc3
SSDEEP 24576:c0Le5ji0hmxhrMR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cPji0AzoLNiXicJFFRGNzj3
TLSH
T1DA859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d5375e898d05f54f3fb3036166087adea9f3160b4cfbe75f79c07925e310def8
MD5 be8428bf56a85ca0267f1f1c81c10d0d
SHA1 e8155da8cb250d7cf75abcc9176801c0acb31a4e
SHA512 8aa0d9b27e77e16b9de4c3493eba4a27acad5ea9389f11ddae920b5f18a2a06c2ad632d48d1288dba65d6185537b637f16739f4ba76a2948c89adc04d6d8757c
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWj6q8wyu//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l/ezSC6vUzPv+HjykLNiXicJFFRGNzj3
TLSH
T103756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 59e829766dccf00a026e5f4b5c1ca5736008de63ed02b306e239d98dd195323a
MD5 133d7fc51e7b2aa89795ab272c1aaac3
SHA1 56b4e6154643a1f32fb64cdbdd185cd6e0790d9d
SHA512 4de2de5ae74befc19fa1c965bc1f3b9275b223db4274876134b7847053cac4accbfe3e4d4c832bf88f8d8ee47a45d50fb646e19f42b2d1b80a8226642584c4a9
SSDEEP 24576:6VbqPb88hv/l+BC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6VO88hXl+ILNiXicJFFRGNzj3
TLSH
T1AB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8445ad02c3ec386026d0bef28cccc1ada4e4eaf63d5e3a2694a366ed3d0c087a
MD5 13303f229e52c7068d4716dfaab6fc26
SHA1 8978b41036e6e17c05695337139adc2c537d54a9
SHA512 0cd5350d7289614c1cc9433ffcd6bc2d41e6d5b3d2eeb3c520de4b9d8668061b64658d75e3b3f35e01dc4ad603139c5645e6ae4b33fc545fb77258ebaea4566b
SSDEEP 24576:GGl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LLNiXicJFFRGNzj3
TLSH
T1635523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a347c61ff530279dc7ff90d3fdd79007b2a2cd8dff9395ceacdcb299b88dec67
MD5 f92c80ae297fda554ccb0a1bd6e34897
SHA1 789c9f7f4769b9cf52f9f525cc6d1bc9167217e3
SHA512 6ceca87caac9195a3b3a8992eb2a385dead91c41f75a5d6fd4815b5373e14a3f62813ea7c4d261d936ecb1883845fcf3c6d891a8635b66e3823bec68d1b71423
SSDEEP 24576:NJIU6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NJIU6LNiXicJFFRGNzj3
TLSH
T13675CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 472912a2452a35bc070157fa97e0e847ef3323e327031d0e7d4bdab040e6b652
MD5 bfb219e05baf6d73b0d320f742954e43
SHA1 f685efc563b871d29095859c526273cbf32dabff
SHA512 354ad9ee82da4e174360b69bd0c83ff777d1726ba5cc83cd05b2d50f6881cc43322374099158c1f9fbab495ec17b9f44e5c2b50474e05a04eaf63a3f995cd7ec
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THE:VQvGAdlCEL8c/WRNw5CP7wRGpj3
TLSH
T108266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9cd94263cac0a2eea66f07fbbd6a6fb7be5ccab8bb75cb19efaee2f68b9548c2
MD5 f942d2f43bc8d17194da82f984a4a46e
SHA1 fefef810bb314c715c16d1f9815642ca091a2dec
SHA512 34ab4a69eab77699c0c779fb2a04c91d6f386324cf7e59bd31f3dbd5ff9e79c5c0c0c308d1553bc2fe3e37062432d76397338d0d6d97cae15fad077a8501ee4e
SSDEEP 24576:dfewsAj4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hlj4LNiXicJFFRGNzj3
TLSH
T1A875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 70d704e5f46822431ea915e18bd6f19c10f68a0ccf3e1b9798b41e0d7cd9b709
MD5 0ba5c4a78634671d3c1316ffe7c7dff0
SHA1 c04c0913660bcb4550b8e956fc24dc5ea050a40e
SHA512 9d558d4f8f7b16223198c2c487b1f31cf07071504050265b0d3bbdb8db5c12936c3a00ae577fd04c97a97f1d13fa89b9491ad7a44c44c064b271676b50babbe2
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH8F9:IUEtQevvqc2W1cpV20I32A9
TLSH
T100474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 192316ff20ab72668bcb2e9ca971e5ca0e2ff37ced059a9badbe14d285c855d9
MD5 5bd002e83e3e32d4db07981f3733647d
SHA1 03fa03ed58986daebe3cbfc53297d620d4c37a7c
SHA512 5b9e63225137fd8b31d63c82befb2834b9a5a75b82ff26089a58aeea13177775adc55f2532b825c5369baf7a9250c8c0ce1a467d5398eca9881e04a3726d7103
SSDEEP 49152:LCbRquA/m2yL5zLfFiV+XenmE3/zYLNiXicJFFRGNzj3:Uoq2Vjnmb7wRGpj3
TLSH
T1ECD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 60bc1eaefb61362e524f5de14122e163796a8a4684cda33d29b8c48fbc6c9745
MD5 efb201f7bb9062106d4a48ead1b557a2
SHA1 2d50e60714d0ac84da00a40a3f7ddf6d32dc11f9
SHA512 28d74efa490ee1e6d3c016659fc7764779ab0f6e254357c35801e367693152e1e4b7ececd3740b03c9b33823867142fa3c0fc4f93d475fe50567afe4b17ef161
SSDEEP 24576:aAhGL6IFoiwtA5l7S537/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aAM5Foiq5rLNiXicJFFRGNzj3
TLSH
T103359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0604dbf56ffe4b6308d788155110b6e50262b6ee7c69a6ca1e0bdeb1c797f1b6
MD5 448efb12c20b6cfa3621c0adba997b88
SHA1 57329e652cb36a6c114464c72edb8c284a05a456
SHA512 ceb8176bc5e6f7bf2b97caa6f3b51e79253fbcc73e525dd16de8bfe516f4d65c8580d80c32d8f8e97b514be132e2b67bf9022516f582efa5080ce15f548bb298
SSDEEP 24576:ewuROWE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ewSO3LNiXicJFFRGNzj3
TLSH
T1DE65F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 734cf85d88c0b4d93b38588b655a22bf004be8031478796795184dd6027f84f9
MD5 d4a009979e75c9e92b585cd9e6a50e96
SHA1 2ba46ebf7a892a966045a2289a353c9b53cdf58d
SHA512 e8dc28747183ae4426d1db699b75d501986a04a7a1acc3976b7d04412dd6ebf0e824f48c93f33c00f342b44bfef5c63375bc927f43b98af321e1cd03a9e02e0b
SSDEEP 24576:/ZuJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wLNiXicJFFRGNzj3
TLSH
T1C055129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 424fed771912d453bb8762dea6520c1f9cfec48d627f5819b15e093e16024f1b
MD5 aa89a554e486f9040e09085b74af7e6c
SHA1 06dac66844e013d7ac42317326a76318580993e5
SHA512 9d36a1b9b7c453f12a2bc78f0dc671aefef554dc9b1690cb0e62fe60ec21b667cb7e29d9fe27bfdcb3a7bbfff5ab7b339fe973a9022d5c9330a0a8c9d7cc0e93
SSDEEP 98304:5QRQyi36YOcPDLvw2gAf+PN3G7wRGpj3:wQyiKanX+PN6F9
TLSH
T121667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b604154a15d79c4d8af6289216d81086a63287b192158aa6bdb111450469f1e1
MD5 683ab69702c2efd6a015f91657b7fdf9
SHA1 ce6dc4afa07ddaa0142037f92bc3fb65c4214287
SHA512 66ff6a00be80db27e541c9b508a8a13e3edb92e13512f08de331b54e0ce65c6a796c15c1f02b83392b5338fe2a3a27f3eb83d9a553de99e9c7977597387ad9b1
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3G7wRGpj3:vQyiKanX+PN6F9
TLSH
T1C9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d5581c4030cef634e83783e3205508476ba8f8a339e09646c27e3265e5840712
MD5 ec9426066cd5729dfde17aada2672b37
SHA1 b91474d74e25208c69b4321641b5f68e1195db64
SHA512 5c49438472ccfce8ef962d5c51187b4a395a0f8605ab4c90eb5b3909a4a126f813d4dee1be09f690a7dc3cdda20c00c6ee6f3bbc303150f58f9ba1978dcdedb4
SSDEEP 49152:+68Qg55nhkeWu7PNU3/oLNiXicJFFRGNzj3:MthTRc/o7wRGpj3
TLSH
T161B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 76cb7c5f3ed542b3b7c1561d594b5b8fa4a215928e24d9f18120ee30c10ba75a
MD5 ef3fc642956111289e487fec67a4d34a
SHA1 43c2279daf2c5b091616b3a10574c7746f85689a
SHA512 2c33109cb37b5156eb9c72b9a8e1a15ce9ffd4faa0704d2073dc2aba539f7bda52bd5a85bf2fcd3df28614e6a9ec6b60cd46fc6c1e4ee3347cd96675f41da245
SSDEEP 98304:Qy5112gYy5azzVvU69nLKnhZl7wRGpj3:pLIHRWhXF9
TLSH
T16D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 63dde79da990606143d6f28c8356046d784f1ebc75c2b2712852c9de8d271921
MD5 346b50c097bae525fa49e2520ebeb989
SHA1 b1c765c93c4fe9b8f69c73b5866b92794f9354e3
SHA512 b0a3da7e6902782483c39a4daa343b05966f1b4d2078081ef0e7dde5b783112210dc887cc5998dbad7de399a7c637b24f1ba94c9b861cf2c084fe97d4d6a33c0
SSDEEP 49152:VB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl+LNiXicJFFRGNzj3:bu6JmIxd2d+7wRGpj3
TLSH
T1A9D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f5be9018742dfbf7c6be874160f9fb440e096b84ee617a30a47919ae1f50b89f
MD5 6fdeac0bce68fb9a43680e395b0c3d2e
SHA1 23520f906d6a3283a03449b5deb1b3b80696734b
SHA512 9243768735333c637d6b1d27a0294fa3f5afb38a72eab5398c787678eb863facc75565204d8a1ee81c79c52bf4a411d2931a2454b36f8a1ebaa963ff61b6c6b9
SSDEEP 49152:N1hpsNoJpF1A67U44CwH7R4xaLNiXicJFFRGNzj3:NmifPqRb7wRGpj3
TLSH
T1B2B5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 137eea24ef7328dcf350f1860f2dd764d58bf62e6c8020d7e45fb93e09337039
MD5 b571fbd5097f9d006f187cdc8a13098f
SHA1 f850d23efbfc2a7d0077eb42950c85e606efab7a
SHA512 66b5b921ad7f798bf8e4fa7982a172ef8ea6f283ce364de51de35ae4df48e275d6f4256079a4360bfdaf46f0b955bebb67269ea9c226e917170822ba539c2c78
SSDEEP 49152:nSuZQIY0Be2KkRVtOnks6NMHqJLNiXicJFFRGNzj3:95dKqi61J7wRGpj3
TLSH
T1DCC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 650467542ce2221928332277a64380716b972a1961b52aad14ccb667567924f6
MD5 227b825f8453dc70d2e7d6be912083c2
SHA1 ccf4ca3eb87a61f84a3afa56b1d7b45aba5ae2a5
SHA512 103ca0948e11f6ee98674e3ce7526e7e469ade7094f5060b5f57a033bf47fc151f2f86ad7d504f190f1f4e9b740bfd40cae528eca190cb19f25c4e397744f01e
SSDEEP 49152:WhtSn8EApI0figjgiDn0AP5wOLNiXicJFFRGNzj3:3X2iWphX7wRGpj3
TLSH
T13D95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5368ea7e1c3beae5c0d2cc29102d3405e872cbe03f49b0c37e1d4d4f814822cc
MD5 9f487d3f4dcf6c1a7f4214b0499b0916
SHA1 267f6458f4787313eccd6d53e9289a6c801118a8
SHA512 7ccb9a1b5ad1b4d08805854f4bf5ddd50d0fb6512fe03ddeb8034aefb89c75d326c6f73aa91a2332de914fdcb42d10eae47c36a7228ff728f72d1327af8b903a
SSDEEP 12288:qxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1245523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6773752e4ba039178f84a7f25a887919ffd0cf537822afefdb28aa717b49eb82
MD5 b4d44034e2650f76224439463021a0dc
SHA1 4a0eb8df37cc0fa6e7d39485c84c9dc5cd1b6959
SHA512 8f3e7db968002aed26732d0b9b626667442cbc71d4311ec33b0af9440fe7fdd1a977e59a3337657f252436edfebdf0e785cd2e00f0cac6778b4bc71856af2723
SSDEEP 12288:mKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1675523D3558945B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7b9959c33dff7d58b561dd0f78ad4baf2be609ce80045ba7ca0c678b090b5d1d
MD5 e419c9730b225a46f40fcf2a486fbaf7
SHA1 486fedbe51a76ba96561b25ff6959b2fd8ae7ee4
SHA512 4715d29d4f5951980e1004a4e695388c9eb2381cec36228943ece21b5827ef052450f06d8b808d1ed83107b203dbaa9415e88eb963cc569ce3b0ee83a40faf90
SSDEEP 12288:LgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ly/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D15523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9b0a161478de7c3bb6fcdc4eba1370b844d766fff6bf9e13d45e0738ea978d38
MD5 0fbd342d9e7f25f0bb928caf9ac8ea42
SHA1 037328a7b49b038b41c748d711ee9a3599e8bb10
SHA512 95db3f9beb0579e48d7ce39fdf9c033efcbdf33bdd5b7b507d20711d8731f67c1e3d24d2613d5af331af4e6174b3384f8b2baacf884a9b284934db49c0246c60
SSDEEP 12288:VVviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C8552393168900F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A75BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 64ea5a6afdd628a5ab60540b95bfa1458e752fa58340c9400dea6a42766f8165
MD5 10810d58ffd621951160f9b8f29a8d9d
SHA1 c6bc61d0b0066d630a723b725cfc612b1218c9ec
SHA512 664ea7797e622d8a3b4e5fd2e7de068f0a9a9a71954bca73ce63361ba6d7a02a5b39c472aa13ed64cc605ce7f8cca7999e8ebdc9b1ff78c7db41f5098f401915
SSDEEP 12288:h3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e040cae1aa37e80287d7879a468bb590b50a5ed25e16a32f6a09b8239da7acbc
MD5 887f3300306e1e86ea38f16a1278b673
SHA1 0c995f2d56deca077417eb472cbeccf8c25b4650
SHA512 8f2e52a6516eabd56d6fd241ddaea1e7fcc60092a91f02c1d929305f8bb1214c5bc8248bc09426fe0793a07d78ac486c97d2b274b4963c140b31d259e5f6b4c7
SSDEEP 12288:OGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ow/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523D3558945B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1edd87e444c43f5a2bfada94711e4270539c386621383bbf51c94adbac4033c2
MD5 d06f9e36cf361f3a835ef94086cf8e93
SHA1 b46ee1011ae4d7459beec2f8ca88ec9d2aef47e3
SHA512 a796be86adf1d94fcd756d0bdef45cbc066adc456fe1b29adac005d7116ba17a0ea4ea8e4fa1f1531948156f4b15d27ca615c6b1cdd81c2df8adf43dec201c90
SSDEEP 12288:eSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1275523D3558955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 cde61cdfda1c775c32cb5414e1bf4db041ff612ef8bff493b3f878030b798b49
MD5 4b2cd937adf05de873695846eba41851
SHA1 6585c3be19bbe74d67d50799d8f579c3900bbe5c
SHA512 af39847725e0b0ca0965633915f7d6322bde0cc9f3d5976d26df9a0ed37f17d41b2c846ca66e4585df5371135663950cdcfaf6612a0569b40f106f99802749ce
SSDEEP 24576:GZM3zFVSOs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GZM3zfALNiXicJFFRGNzj3
TLSH
T12D750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d9d3ba44a1ebf767250c2666bda8ab5cd5820ae3f50ffb3fac47a0b203baaaa6
MD5 4ea8301f78078742baa2922ab69a7883
SHA1 c768aabd3463c720118dc309df968b724a5502ac
SHA512 39f519f6d9c6b1ec00e6d1168667876d9dbfceb3484bbace516121beff2187608eab937fbd7194f32e3774d661db39daca78fc21e043f8f1d67e4e13f5ceded5
SSDEEP 12288:y1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1655523D3558955B1FAFC003986754428F5881E2DEB5619E3E3483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b9a697df32ad0a406599c3d157247bd9a1eb6fd1850aa5662c2e4135155f28f9
MD5 2798dc7c08e4180eb990946a8d90cf8c
SHA1 e0b6b1e8b34ca1a692fd8f8afd51e60f0fde8ee5
SHA512 ff93674da1a20fb6e7f4a9479026fbf2a05ed59f09d35789dc8086372578610ac3e10ff8c48622a31e8fb372d5503cec779832dd7eeb9adfb7a872d2b66f4932
SSDEEP 12288:/piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EE5523D3558955B1FABC003986754428F5882E2DEB5619E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d81a61647710ec894c83b2cf9883f641ab8128f2250e6e63d91b76da5cce3754
MD5 8ed8af6b55c677b2d8b4c7f4bb3018bd
SHA1 806f049d6adf24c9fd097ca9f471ace82a9af581
SHA512 275a5cb918a46f1d1af7b8bae0e88f2ae8a13fc848847bc048e155675f3428f04e3964f2ef28f6f52d10a6f98ad2ef1e799dba7e705da3f8e6a5f9decd9574a8
SSDEEP 24576:FzyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FXLNiXicJFFRGNzj3
TLSH
T198650243629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cad8c17b90a7cb8dd01db71b0b2727273cb6e99ce2bf3c1fdda872e8644e65b2
MD5 b7badbd63710b42e1b302644ae282368
SHA1 0d3f9f00b4490ef6f36e278750a3394c606dd88f
SHA512 d7546532dfe15d9071e9648fed43b411340616194b205311f245a7d9c66e50717e0e92c5de081643eb93f716fc85002cd3a4216a0035462784b0eff8e4c6fc77
SSDEEP 12288:i1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1815523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1602eff84c1cba9a502c8501f5097ef92634b5057d1813bfce62edafa9c44d2a
MD5 23cf6ba09af3d8f2553e32d4be1e17e5
SHA1 b831618b152b54443c83a04a55d37b009049da23
SHA512 e15c0351a873ff2557d41268a647cef4d5ce35fe355df292dd0ceb1753b70c2510e693c6a539b361681c4b8a1c2cdc5ecb2992daccd73b8a540bd350c2ab18a7
SSDEEP 12288:21iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1695523D3558955B1FAFC003D86354428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2cc34846e306f0cea77870706984c451317746335200d31eb67a1f91549ad113
MD5 2e6947e35230f1c6838594610ce22063
SHA1 66a53c3877fe4bbf6ea033dd8a7e7922a61dcbc8
SHA512 8e6089931c074e314d66ccb2b0ceb5fdd2fbbc8237fa1812d241ba26c84a9a23bb9a4afee6dba2a228e65b3a2b541fb299a5e4e5cbffab7e938e29340a4460ed
SSDEEP 24576:IzyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IXLNiXicJFFRGNzj3
TLSH
T1E8650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 1f9540a1f5923520b2ea417f01a9516a67c122a32c75b9e0726af1aeef23381a
MD5 0276ce3d349a55eec4aa662568adfbb4
SHA1 d89d7b52a503f024d3331c1a93155a7937a7235d
SHA512 24950f33da2bbd6d0e6a5c3204d43fc06d4c9daca4c440c13ce1518e4305dbaba41d7f5ca585822e86047eb35a970c7ee06fea9d84ee9efe4d85e14704797374
SSDEEP 24576:oT8aLl3z0zDi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oT7Llj/LNiXicJFFRGNzj3
TLSH
T1B07502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 da4b8a57ed48d2d8eb057e8e32b09ee1c9188cf55f37b523aa2a024709f5d57d
MD5 9533413800d17c142892db95599e6e98
SHA1 1412e243443866baef9bb47b125f5e0e67ed5072
SHA512 8300310eb1c822e91aee18d389ecc476b17a55a5fa10d5560f372915291ecdc9e34fe9fc0e9de6ae28a83da136c1c1a3a752c078a59d9c8f9b246c9c4dd99836
SSDEEP 24576:33rd9CHKy7GZm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Hrd9CHKyaALNiXicJFFRGNzj3
TLSH
T1B885CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8e8b7e6c224776843b07ec1b5330179b9e8764e6c0b26d644abdd022cdcf44ad
MD5 6aa66f76c98883a61bef4e7b323fff60
SHA1 4dfc1502b89ce03808b0cc731eb2c865453352a0
SHA512 60dfe1afb8ec7e899bdcd1c6ad6e94418574e421fa7ea4284df41a7d1472acac08fee977d088e41a082eb8925192c1f5ad86f279c71cd9a062e3009001555914
SSDEEP 12288:ZAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1975523D3558955B1FAFC0039C6364428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f7010d0d88a6e96eb6acc4081f2f4a4ce0d966edd810034661695f8d46b56972
MD5 1c28d6d69633811660248a3d38e7b95c
SHA1 c6858c3e552bc77e7df1599138d60b8280a91b9c
SHA512 65de316f3732c3b499ae3fbd1967bc9e7564a6ba458d0270e1bb1adbabd60393ed4b5e5769b1be6c5476b495f7b92b8d375054828626752fe7cf9a22776f0148
SSDEEP 12288:IeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Io/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1715523D2558955F1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0174b3dc20479caf880de14cf00e46a0755da8b10df83295598c0d5f46233667
MD5 27f2285a99e73f00c10f21becf8276e9
SHA1 8017ed37b9ef64ea831a00d326d9bed65e8b43b5
SHA512 bd40b78bb564483ad2cd5f1ca9986037be6db71d216a995d3c5e6608bc35fc00786526e8e76b61c422c1dff3731635cf1f6442ecd40085eb0363cf6fbdfe249c
SSDEEP 12288:tpsfFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A265F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 128192c69c699bbe31c2d6840e386b98df8b598636946fbc62993ed082d67f58
MD5 f413e0a7a479f8fa8f40b8d7c4b2bba1
SHA1 d8fc1bb8c1ebeb392040998d35ffa0834e081536
SHA512 db9c8877e16fa6541d333df74fa44a28389823cc71dadebfd66d94d9519d8aed4dfcb54f4bb87267ee0d2a607d0e54289cf7b8a907f16dc5cbd7f8c58d56d3c3
SSDEEP 12288:ceiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:co/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B552393568C5962FAFD1039453A8438B5497E3C9F1598D3E2043A1EA238FEBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e8bd8c8f826c0e07f10d07d9579bb1364c51b23c273c74ecf6969b9549ec4c9e
MD5 5f2160743943ecf471440681c76b49c7
SHA1 c52cf9c551664f2afee7bfd66188334f8a4a8db7
SHA512 c9a12133b8ef32fe1914309644a3f0c915dc7099d584dac6ee80b136b9ef4c34a68b56f664b489c119845296fb5ae0415359f7b26f5b74a9757edfa31c7bcc2b
SSDEEP 49152:Ia0h2GEkuAe73q3pp46zwwQqLNiXicJFFRGNzj3:Ia0hNYG4Jwh7wRGpj3
TLSH
T10985AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9cb243b526eff543fb0ba9b3668a38c9c4d73f0a12299d35dc13309bf48634f1
MD5 fe468156914f603f405cfb11f4bd4506
SHA1 f1462f266d1c97b8391e5ce08ef7e8bdaee53d69
SHA512 6dffa69e163805dc7dc02c9b463a7947072b19d01478b029b05891499ba398199474f9d027e1c0c78a27d8e01a00ad5a4224faa04c47e0c4c4efdecb334c96f6
SSDEEP 24576:9hbHjPv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9hbHj3LNiXicJFFRGNzj3
TLSH
T1A95512BE169C20E5F6B5903D86668409D370BC29172193EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 67380dd2ce642a820197909f053686250ac92469563e9b40ac6d41d5887f6f98
MD5 a608d2ce29973f5dc8397fb2da62273c
SHA1 72b1a8b287d35160715bb35db12d8b5d0973018c
SHA512 c8aa893edbd0acfc30d4b9b7c5a50bb99d296cd6c2efaf0a639f7416032286f049dced435b8cc65340abbd9adf327979b93ed6f6aba7ebc6bc6dd600a56a9ff7
SSDEEP 12288:0qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D2518959B1EAFD003D867A4428B5446F2C9B2619E3E1543E1EE278FEFCF38162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 344e1e6ee286c26a795880aa3cedaa565075880c809ae6c1b74ebe66f6a419d0
MD5 f62f953f483b5473b003bc70973cae4a
SHA1 eed67ee4592fc8b722cc87c76387204e939de191
SHA512 c77d302f163f77585f31fec730b3dabb9b44aa1982a86eb8cd93af39bbff5d16dde4adb2fa8003db2ff5b2bc6e0e06feb00e9c549ed586355830328f68935abe
SSDEEP 24576:QAL3UT//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QAL3UjLNiXicJFFRGNzj3
TLSH
T176750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 bd2d9fd84b58ed7d6c80226a04f3659b2555349324311bc9710049453ff1d538
MD5 4e09f164d8a085331cc61da4b19684fb
SHA1 275996427a55eb5c91217cd22be0497c66339a80
SHA512 91fa23b6ff9c83369ea7b6ec8b9bb54bd4df1d9ca186844805a10605d67c6085135bcac0a30f0a80d40551133b6f07750f39e4a8bceef5420dcf31e669093cb1
SSDEEP 24576:cOD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cODLNiXicJFFRGNzj3
TLSH
T19955125A32DC10F4E5B9903D8AA2820CE371BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a1ebf505a659cf29dffc3e6875832f0306acefbde5cd68b138548966c1640c1e
MD5 a6e6b93ce7e7cbc52ab3a0e6e72546ba
SHA1 0e1be2a9391a40df018ac8226ac420b7902e82bd
SHA512 f4204fbb3d6c7feeb155361fcf7cc8f07a7bfb3422844bd2eeed7a24e29acafc10c39b069e98a39692a3ed1d12955bfdfd2928e033bd07b0b567230d1681b0dc
SSDEEP 24576:l7NM9YqZqmWMUkPjZM48Mv6bEhs4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l7cBWMpPjN8DbEh1LNiXicJFFRGNzj3
TLSH
T10465AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 96abbb852daed4ec659c4eb1e07068b546941e60e01d6b70997fcc23850dde53
MD5 81c265a12cacc65d4cb724572acb0327
SHA1 c2233138d954f91857e7c6a40eee14c306dc5521
SHA512 53cfdee395b680eeee8314698177282635629b2fdbb38b1dac0faeb7e560bf4be3105856c401c4429a9a394b746dad516c13cc9726acdcd2f5bc10260d061c2a
SSDEEP 49152:fF2YuHNETovAvNYf8kmYLNiXicJFFRGNzj3:m6BCf8kD7wRGpj3
TLSH
T1F6858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f014bae937bd169fc60b763e60832e7d650ce2f787a91645fcd3cdc6a82c991c
MD5 d2fb652e86c9e67dd08c6cf73f0c0d66
SHA1 2d6bf45b15e4c4b6badf736d312f975c54c7b54b
SHA512 5532d73954e7ac673486ce48a61b38738c686932112fd3c841b934e176a8b40b1957a39198271793e3c9627694ed6e8c2c51d3b74ccbd2ee47fb92ed8c042089
SSDEEP 24576:IAFs06+Omlf8NXEbToH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NFs060loXuKLNiXicJFFRGNzj3
TLSH
T15865BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 31e8c53b922368945f7f5d79bb8220be4cd2e358fd8dc32888ba02654f7911ef
MD5 47c49913e8c7a9c98dd348f77df7537f
SHA1 eed99ed5b9f94d2eb29f53d19f46e637fe27a014
SHA512 ece07345087730fd3a784e12492406f7c87f89619ac97330a716897de5c008a2d035c17c0443115ee036905d62325076655c4d2628586cd858bb771fe15f23f6
SSDEEP 24576:aJnJ5D3WXK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aJnJ5DGXKLNiXicJFFRGNzj3
TLSH
T1CC75D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 eb65451752a281ab2989c0db27cc6a33afc63b2361d0254b8529410c8fbb0176
MD5 244dd19ef88feb40c788e17919c071fe
SHA1 c087bab9b0a1872322eded78ae5772aaa5088476
SHA512 9c980be7b674579f60bfaa2c1f59de612d809ea264fe7771e2918a9e3f0da19792f9c8d8f88e09a0186c7b7ed54d12a3a1ae421d566520027fd0e2c9a4b8e4f6
SSDEEP 49152:Mg06DIKdwc+eQnSt65aVULNiXicJFFRGNzj3:9m7wRGpj3
TLSH
T109956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 80ff1837ae90278adbfb8c9364ecdd65676388285c89a4cc289092649212befb
MD5 77e6b00d9fa47cfb64f9634fe16234cf
SHA1 64acbea2e2614362c27c38c270bb21907acc5d6b
SHA512 0bdeb5c2937e33d822afeb0f2d84e277a4e70b3fa415e5061558c276604a81e5b3947ae8b88f86373d42ff549f560995ba4fe6ccfb664419ac8641bd72250627
SSDEEP 24576:Nnw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NnwLNiXicJFFRGNzj3
TLSH
T15D5512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 591cb06d30530fadd82c093209f5ea80c67c427a57b2ad9450fec1d7355330fa
MD5 6c28b0afaee64cdab123c5e0ee6de3e2
SHA1 5f3cc035b4e40467c5c515aad1ba4dc819c483a7
SHA512 044007227caf2e061ae3aad00efc6ab6a7e45ef8a3b5214f36e31a615b02e749d3b9e8798c966d534d1a609ab40d091f18b82cf525cfc2779b31b22c3523fd63
SSDEEP 24576:kIyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kIaLNiXicJFFRGNzj3
TLSH
T17B651245538860E5EAB9013CCA774064EA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 bb5e8072ae04ab82afbeacd5e11dcf71b33cf294a245cdbe3e95119374426b0b
MD5 9e4c071cd99ff9fe3b87e588c4f836eb
SHA1 3766643cff8f07559cafc1247aef19c82fc5051d
SHA512 62c98f981ab7b1f82f190144e36cb33f1b93dd152a2f7bebaf5b9f3990939cbe666eb60e86310691cb8675ddb747670377f3c6d9b885a08ed064ba94559bbba2
SSDEEP 12288:syHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11A55239A118965B1FABD003D86364824F1543E3C9B2628F7A194793ED339FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4e950f7678a75d3c9e8d53243c87e7cd339986d3ff6754213786aa8e53cfc485
MD5 bd2bdaa216ac4f2a3942b1f856bb7b57
SHA1 80df89d3de9774ae05b23940894cabeedfd8e530
SHA512 33d86419a191d8badd3e56fa9d3b3b59b2e4ce8556a2963a9664bfd8583c884082ab4c58b1d97ea27e7087862eee5f5e6598ccf88a7cb6f29a9d48132fa4779b
SSDEEP 24576:HQ9MxZKdcz9dw3A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HVKZALNiXicJFFRGNzj3
TLSH
T14D558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 4345d58c57ffcfd3288fc4d5ab0626f7da430530cbab9931c237a0b7d60e3bd6
MD5 9bd582b9b04b540d1742fe3cfbc7ca18
SHA1 c1521af35162ad34b669da45b12ec004674ff270
SHA512 8c65b8ff954db3f228ed411c4c2642eb65c20a505dbe3bf4ad02453c785d2f78da6644a88de57ed447ee1e765b5b35381032ef86216b40313907d923627e1499
SSDEEP 24576:6yocDApp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HocDAppLNiXicJFFRGNzj3
TLSH
T19B65E05FB76D40A2E176813C89858204E773B4345B6257CB6291C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ffe5743cf455b4755eaaba4a61b12a4f489b004c16bd887a818ffa9e36c8a6b0
MD5 0a5a2bce27f1216987cb6b2f389bcdc3
SHA1 b2970d1cb6e4c8617171d55e4d59d6d163479e59
SHA512 0305924a025f9e188572e715fac03ad373c6e64b1000fafd62a6ee7042d150951e8fd8e094efe2761386c0ab3dcbe0a054cad66197963b048d32e823a28c1011
SSDEEP 49152:GWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKpLNiXicJFFRGNzj3:Q0zuNI/7wRGpj3
TLSH
T120A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 141a5df91e58b67134ef8c95cfd472b4e715de9143e91c12f47f68de3044ba5d
MD5 69754bcb8ed6cfde5b0bd9bbd916c92e
SHA1 ae2f6e84aa9a7bb4ca768f71a6c31f262b23be82
SHA512 3a489328381fcca2c48190a7204b047e44e36c81600675567dbd4ddecbebc341a337234959170117a5a23b60d47adaae39ebdc94aa4f330f62acd250c72a5c21
SSDEEP 24576:n1QT7EcpfxR+N5AWAz3ooiYzjMqbw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aTDxR+N5YzTBjMdLNiXicJFFRGNzj3
TLSH
T13455B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 f4922c28d23845a7dd04ffec46c39344b53f7c19e47332d9bf6ff5c7c06ae401
MD5 d0e93cedc6187bac2dd0d869926dd5d6
SHA1 4a3177f1546a69206a305b472d5cc3d7f291eb89
SHA512 840ce85efb05e72feecb8c9de7bfb3d60aa3998c0c058af99b38c5de82ff8697a7ecd604cde2a5e8aba81ad3b4b4cec9237a2d41f4a5641309f88d3c279e4935
SSDEEP 24576:/3YgnJcRTk4yti+R5dBR/H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/IgnaTk46pBR/HLNiXicJFFRGNzj3
TLSH
T17145B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-306-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/376-409-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/412-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/412-36-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/456-369-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/456-531-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/456-331-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/456-385-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/456-401-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/880-459-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/880-318-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1560-67-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1560-61-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1560-97-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1560-237-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1560-71-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1656-313-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1656-245-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1716-263-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1716-321-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1716-264-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/1716-269-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/1720-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1720-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1720-59-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1720-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1896-458-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1896-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1960-273-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/1960-326-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2220-325-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2220-529-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2304-435-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-433-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-449-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-450-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-451-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-448-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-442-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-443-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-444-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-445-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-446-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-447-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-426-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-428-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-429-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-430-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-431-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-432-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-434-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-436-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-437-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-438-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-439-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-440-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-441-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-427-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-412-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-413-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-414-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-415-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-416-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-417-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-418-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-411-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-410-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-425-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-424-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-423-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-422-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-421-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-420-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2304-419-0x000001BA7FF40000-0x000001BA7FF50000-memory.dmp

Download

memory/2916-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2916-407-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2916-330-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2988-44-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2988-38-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2988-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2988-46-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3068-204-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3068-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3300-280-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3300-403-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3388-327-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3388-530-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3520-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3520-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4128-406-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4128-283-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/4128-291-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4128-289-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/4576-303-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4576-295-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4576-296-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4576-408-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4756-26-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4756-223-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4756-19-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4756-17-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4772-99-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4772-74-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4772-80-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4996-33-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/4996-9-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4996-8-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/4996-0-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5036-259-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5036-317-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/5036-253-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5036-249-0x0000000140000000-0x0000000140202000-memory.dmp

Download