57252835456ad90cf3193957ff9b68a8926733fcd875e84d1342a30abeaa605f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.2MB
Sample260808-resqvsstdy
SHA256 57252835456ad90cf3193957ff9b68a8926733fcd875e84d1342a30abeaa605f
MD5 e47b96479b7efd210f57f60581066798
SHA1 ebe0b112008881bdcfe2ef7ea29d248f80b9dc71
SHA512 8d53c8d8d1065dae57647eb33144ff1eb6f8c60343f2b26f3ad9742e78e624ecb4dcb0a1149d72c441426841a653dd6bfbcbcab08ba42b2f3ce73954108d50d0
SSDEEP 24576:JxVIW5Ogp9vHsZ4kah3MWuGMF36YKN4B1Jdi5hbKFlkJtx:XH/p9vFFh3xu37BvdebQKl
TLSH
T17845CF12A7A801BCD0BBD2798A569912F776780603719BDF03D096672F277E19F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4156	alg.exe
924	DiagnosticsHub.StandardCollector.Service.exe
3128	fxssvc.exe
5440	elevation_service.exe
4220	maintenanceservice.exe
5084	OSE.EXE
1808	msdtc.exe
3604	PerceptionSimulationService.exe
5816	perfhost.exe
3056	locator.exe
1108	SensorDataService.exe
2796	snmptrap.exe
1100	spectrum.exe
2744	ssh-agent.exe
5064	TieringEngineService.exe
1088	AgentService.exe
3916	vds.exe
5732	vssvc.exe
4636	wbengine.exe
6052	WmiApSrv.exe
4736	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9672f9732d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0e9cb643f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044fea0643f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d7e83653f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d86c9643f27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf709a663f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fad65e663f27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
924	DiagnosticsHub.StandardCollector.Service.exe
924	DiagnosticsHub.StandardCollector.Service.exe
924	DiagnosticsHub.StandardCollector.Service.exe
924	DiagnosticsHub.StandardCollector.Service.exe
924	DiagnosticsHub.StandardCollector.Service.exe
924	DiagnosticsHub.StandardCollector.Service.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	628	2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	3128	fxssvc.exe
Token: SeDebugPrivilege	924	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	5440	elevation_service.exe
Token: SeRestorePrivilege	5064	TieringEngineService.exe
Token: SeManageVolumePrivilege	5064	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1088	AgentService.exe
Token: SeBackupPrivilege	5732	vssvc.exe
Token: SeRestorePrivilege	5732	vssvc.exe
Token: SeAuditPrivilege	5732	vssvc.exe
Token: SeBackupPrivilege	4636	wbengine.exe
Token: SeRestorePrivilege	4636	wbengine.exe
Token: SeSecurityPrivilege	4636	wbengine.exe
Token: 33	4736	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4736	SearchIndexer.exe
Token: SeDebugPrivilege	5440	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 5512	4736	SearchIndexer.exe	114
PID 4736 wrote to memory of 4480	4736	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e47b96479b7efd210f57f60581066798_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:636

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4220

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5084

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1808

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3604

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5816

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3056

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1108

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1100

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5604

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6052

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5512
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 187e3b0c8bb9f8fd17cfd04bf0a19ed216a812bc01103f1efdde96f947b94be3
MD5 5ec672acaf132699cea5f49efcc21fa8
SHA1 9614b25d2f8bef2c486d744c9599efecac75cce5
SHA512 d4bb3f914975db1a03483d247964b146f849e8bef6bf2986a383b9fdd6b6e1ecc06ecc0f1e352e2159988391f3de6391a21f009534af708e96bfafee62ba9d31
SSDEEP 49152:ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxn4xu37BvdebQKl:w3q6mjBev8Ll
TLSH
T12CD59D03F2D900E9E06AD1B8D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 64aab731027d0adf93d4c366b35882eefaf4f5c509620248c035ca22bf5a4718
MD5 e1c87db552d80072165343e15efb8b96
SHA1 a87ac469b417f20ab0fb4fa0d6878a20b1789785
SHA512 968e89876aeb8b1d03cc2aab4becbc89e4e615c003b6240f402b09f428f39a0e5a8e2f8b147c2f2b35ad80c549df2277c4c016b80748a1c23cf4a361a1292855
SSDEEP 24576:eXYfDtczAVMWuGMF36YKN4B1Jdi5hbKFlkJtx:9tcOxu37BvdebQKl
TLSH
T1A505F12963D408F9ED6B92BCCCA28516E6337C510760EADB03E495391F233D85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 306ce8f9f6536946f21515ff46522919dda6df2de5fa7b2c691d69e19583bb48
MD5 b7d12334ea34f1dbb935d9a71c5589c9
SHA1 8980ae227894592c7e549f9716159059821c2eb4
SHA512 fad9badae26b45cc450e3edb17f03d6f3cee9b286b7602605dd7fa1be4f65828751fa09075c94cdf90f6e275d280f4206a2663e6c486e7e01489763cbc7bc942
SSDEEP 24576:P0Le5ji0hmxhrMwMWuGMF36YKN4B1Jdi5hbKFlkJtx:PPji0Az3xu37BvdebQKl
TLSH
T1F6359E16F6748331D073C0B9C5D2A69EE97234861B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6cb7e3db93d8862d853280b1736075fbdc9841603828b7be6da8056f91aca6b5
MD5 a8904354fc47328a813776e2c7562cf2
SHA1 8adb89b480ec41e2db92e76d3c84d1392d202fa7
SHA512 8e6591b3a7d1bd725d25e706c6c67c28800572bba6c7edbb653b6180eb38076cf4640c66c53a37d6a03b7de9c265b430bcfdea0cb36dcaac6feee2697b226008
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWj6q8wyueMWuGMF36YKN4B1Jdi5hbKFlkJtx:C/ezSC6vUzPv+Hjybxu37BvdebQKl
TLSH
T12D755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d09833755bc1ab0b70112b6cf0c13a172b28ff0b97076dc995690b5be20d98da
MD5 8b9bbf0147e48f5272c5c179daf52f1b
SHA1 6092f1881308e610e70085fa9d743c32d4030479
SHA512 47fbc9d072c4a197fecd2804d2e94c8d7fe6e44f432e8283eb6b2ca41c8f43ab3b947da49ecf6e8945d07589d44502bd8432bd27f0269223accc35efc84b3261
SSDEEP 24576:mVbqPb88hv/l+BRMWuGMF36YKN4B1Jdi5hbKFlkJtx:mVO88hXl+Xxu37BvdebQKl
TLSH
T12E559E66F5B48331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 683c151e3d673e44b2d512b5a19e299922b31a999e558b7bc917ea8cfa6532b3
MD5 0fcde8c0dfff6978ddc0af70ea85b452
SHA1 69317e7daed42b0a019a801f700db43205edc6a5
SHA512 3fc4942c134e566370a9e86b1e7f17e727c5f57127f1c176769b902e9a3e6f94ddce0422c267d48a03776da8af8bfc2dd80fb03e0771c306b6901ad0bd6bc885
SSDEEP 12288:yG8yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:yG8MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T155C423435185A031EF2831F9AE7DA95E91351E200D20EDFBD690727CAC7A362E8C5A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 8ee46ecf6e42ec9354cf0b3c6998980e077726a2178f050c79bcb67d23d99de1
MD5 8acf8b02e8f21fffb819aad9a2a26497
SHA1 ed94bff7050deb2c1354d46d1b8aa5029d0310a6
SHA512 8b548a81252f6c55199d90ce1203afcd93c34268c354b1f8a6211e8f09179a665ec20fba7795b030c1d6757840f879bc9faec4c06048c1fcb2b1b4d90895a1fa
SSDEEP 24576:rJIUpMWuGMF36YKN4B1Jdi5hbKFlkJtx:rJIUpxu37BvdebQKl
TLSH
T12F05CF3BAE28FCE2C67E5DB95A91C600D77278304F61A3CBD164820EDE235E15D79C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bd3eb1df25213fdd308d12a3a51ca8c928aa24cbe863c93d7f9e6f6834373ad9
MD5 239ca1b3c4fe51069ad5d9c84fe812e7
SHA1 b36461691552b30aa5c21ea445820f5c96c2aaac
SHA512 8c7d00ae3d74feba95337eecf5d0ca335e9b11b62b7865afbbc2b8097536c7303eb13b661ee733ee4b14e54fdf3b63014778b1122dffbe7f88499eb672fb370d
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THL:cQvGAdlCEL8c/WRNw5Czv8Ll
TLSH
T12E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e5e9cba629d8f31521e5b8b257f820feccd7554edfa9fbd98e702c59191c1264
MD5 65c62b0be5db4de2df0006d875c8cdb4
SHA1 d91e37a7f393eb9ea701073787165458ec31d552
SHA512 a49a05872c83ec167a6461e5ffb0b34dbeee35b0856d62b0963aa32ddbdcb30c6d0bfb472bd66509b889c3945aa36faaf5d5c461a0c24524f7f1f00b37c62083
SSDEEP 24576:4fewsAjHMWuGMF36YKN4B1Jdi5hbKFlkJtx:yljHxu37BvdebQKl
TLSH
T10015EF31FA74E032C67B0DB61B36D71A543D6E200F611AC3E3E89A9D59302D26776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 34a4e8321149d7d4def124c5817fc1ae8d8b5b69cbf51c4923e43cb33e85d616
MD5 528202cbb5e8b7d4eb268b953c1cc8ad
SHA1 a4b6d28c0d5a2ab2f6c8e06fcc00c7ba7750735f
SHA512 bd5a2523bf79e90a25da798eeb3efb270178e00362aceaa1ac9ea4decc3a11d3a638d80096c853a032102115aac889351cece4ba26c390be8609a86e6d8ccc98
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHI0L:uUEtQevvqc2W1cpV20I32I0
TLSH
T14D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d713181ebec1aee6ef36d89f0d2fe253a94c5880ea41f5e57cf143562b6e4b27
MD5 cc89161d6124e311107a5ebbbaf02395
SHA1 3ef9d2a41fa70b99b804da9ebfca3f18114a3841
SHA512 7398a9b6a71ca3075e9ca91ac3d6e45815024e87f1661428902877f2d7c08d3afa60ddf245af85ab31f054c1ada675ac7715ecbe6f6665050fdc5ef0eebf7599
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/znxu37BvdebQKl:AoqtVjnm/v8Ll
TLSH
T112D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d0e272f049f4e4d86f572e3d0f5fad37f506e632eb3486e1e30bc7cf017a2e61
MD5 5989ca28ba5df56511881b79e089ab12
SHA1 07d741a58d8a9ad0cbd8b1d3ce2a23984385444b
SHA512 5c17adf927ba590d6bb9809aed4b714632fb1e11849ec40a11b3ad9f1beba900add541963c4c0209603033e90abe18469ad9ee53a7d23611620edc676cf96e62
SSDEEP 24576:MAhGL6IFoiwtA5l7S53SMWuGMF36YKN4B1Jdi5hbKFlkJtx:MAM5Foiq5Cxu37BvdebQKl
TLSH
T19835AD81E7F955E4F5B3AAB89DB69171EA76BCA61E30C20F2150D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ef29f5302f20332f5ee6b3ac7598b738ae51e92174f438d5b9e3a9820242cd15
MD5 2ea368aa7ef415619173bcc2d78d7189
SHA1 b1e19707a9b2c2072ef7871ad01fe113037f728f
SHA512 aab81e8b14bd29a7cc3a43f9f15458e7c60fdeee24be7c19ce8d28a01a5bc2fa0339ae5bb9f0c73bb9dc3c940f5673dca7f77cffbc51053d0c64c25f6cfd71c2
SSDEEP 24576:8wuROW7MWuGMF36YKN4B1Jdi5hbKFlkJtx:8wSO2xu37BvdebQKl
TLSH
T1C105F14632E40CF9E9665178CA57C536F7B2BC112A21DB2F5360C66B6F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 79497ebe986a75b899a64004e422fde6292486318ba58cd821cf31fc52cae7bd
MD5 3f7972e126b16a644bcd3fc459d789b2
SHA1 332bcac80cd9173fd66267b48152b5c39abd54cb
SHA512 c83756a45f2c2862160cc65db058f31c3f8aa40ee061d5357d8b941fe35c7a5de4a08b5aa9c452a2daca7f2eef8afbe1e9c044a356fb73f8ecf21cf6d314857f
SSDEEP 12288:PyZ1IyXyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:qZuIMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1F5E4128632D460B5E66662BCCDF59A0AD3723C22173183DF566052782F33BD29D39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1659d141ca56c30469f9e4316954fccf48417b7b3ecb235527250bad884da6e5
MD5 796037a4a975714b8a23289acf3937ee
SHA1 c745dcab0c32493bc132f1eda0f6c590100eb63e
SHA512 ff7cc84af6955360e70db6d3567784599f843b6d9d4581667ab8edd5d99ea2521ea0113c51261c63f10067ac3fd71f7a413f24f2c04a21af8bb9024ded82e442
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uv:hQRQyi36YOcPDLvw2gAf+PN3iv8Ll
TLSH
T189667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3c8e94e2eb5351e3fdfd78f20612064f9726e39fe1d309672be6ddd09c0c441d
MD5 b51ab3f08a1e3924b1de91b69ca83748
SHA1 f33554a3fbe9f21d20f06b67ceec85e92182c25a
SHA512 c224e7599aa869d10d8040d6ba01da7671e8bfe0ad28993e4b6ad54a607da33f723d5ea1c0da0e07e22eadcafa643165ffeab42d73d1c7e0cb37643fcdaf90ba
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uv:cQRQyi36YOcPDLvw2gAf+PN3iv8Ll
TLSH
T178667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 59f0fa118d513f16d8ab97f4127d34050c538f210c1a8a36fd1ce1d519d9718d
MD5 d4677b71823ee525639c4de099552d64
SHA1 270fc29475114da8f9b31792de61cab569c9697d
SHA512 f270b05dd8cc79eeb0459c5a5fce51c1840aa87ab505ceaa28ac0479eb32c1b4f838c1e7c7a9935aecd9794434869f809a39ab291fd610c035b3360ba9bf8558
SSDEEP 49152:D68Qg55nhkeWu7PNU3/3xu37BvdebQKl:9thTRc/Qv8Ll
TLSH
T1F7B54A33B2F600A9C44DE1769F4A872196E17C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0f35b893345e3ee87935e0dababe355451d8d5db6bdc382caf16ca9595c53c4d
MD5 d8d00ce18989efebac72597b689328a8
SHA1 675c6070085298f171c449a4dd1e552d776cf034
SHA512 427d230603c7c18968b4790eade8d4ad615f72ed1b762efe563d7ad42e46ccb3d6f5336c06b12fb21b98af854afa89dafddc265ea940df4bb8736288d5ec11c3
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99l:my5112gYy5azzVvU69nLKnhZlv8Ll
TLSH
T16B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b153923bf11f391c4835bd4d9791c7e22899838415a63653e048de968523c8d5
MD5 bec6250113279fe74e525231a0168c1c
SHA1 bcdc3a08c3a35c30c2b02170f7a40e6634b995b6
SHA512 fe5553366bda228212505f06cd33abe8c8c97a67c40cf52f18a547204846d10e99094508e63c3978eeb173059f076a7417080c0fbe9478ed5b911625af5aa750
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glaxu37BvdebQKl:6u6JmIxd2dnv8Ll
TLSH
T1C7D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6EF0A9073552E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7a44d1b62545f097c8c7be91d4c39049b9b5e51034aa81d919543ab38e861e24
MD5 df1ad5fd5b06336605974e5a2dca34f9
SHA1 42beff7970a7a7f363251af4fc17fd32b5dbcd93
SHA512 157ec5134ae218a734c00f74408cfdc32a3c56025c643b0ab3f6f25f551cee279bd6006b3a376592fdb0df94e2e78a0cfe7324575b5a50048d2066a9c0cdc1c7
SSDEEP 49152:V1hpsNoJpF1A67U44CwH7R4xJxu37BvdebQKl:VmifPqR/v8Ll
TLSH
T14FB5AE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 eec56e50bd5c2e042f4e01280eee4a0dc8e9e07c31b76a4a60dc8162f0d81aa6
MD5 f26de4f21954eab43082cee2603d64c4
SHA1 aafa968d5e4ce60751cef598028da6a261b25331
SHA512 6a5a123ccd015dc3c66b2f3e596d4b0bc1f899c40c616085ef376b37f7f8407101fd16fa5d5c94e8b1670a6bd2a4d92b2e4f2181f00c22b503d0f41dfe42cea0
SSDEEP 49152:QSuZQIY0Be2KkRVtOnks6NMHqIxu37BvdebQKl:K5dKqi615v8Ll
TLSH
T1E0C5BF03F2E940E8E0BEE67487659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8dab94d4aad49425211eb7d6512630a6cf3440774916cfc9e253e705aa44d40a
MD5 6f27d6cfdaa4d095b438ca95c970f337
SHA1 d64b17c4eba68ad3f2073985bbef202ce93c5c94
SHA512 d4a8089ef547e5f8378452f9af5f13b4e6e00a1cd7e92fa777d4ad2ea76abc46503ba7f20d27b3b8ed449fbacd500c9737e88c2ca3ce47a7f82d0ec1a50f3168
SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5wVxu37BvdebQKl:oX2iWphbv8Ll
TLSH
T11495BE13F2D900E8D05ED1B8C7568632E972BC150B34AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9285d408bd19000a192a3f37ed20533d68c66892f27103e3409a61a40532a7d3
MD5 bf1001134c4432c9e19062c02d3b8c38
SHA1 253c9b2261eee2bc6554ec238e25e33fe19bde1f
SHA512 4b7fd32b761b65ee32f039018c9c7e72aa10cef552535dc70dbb95f9b8903a9e3d4e8394f06723018d990f1dc5cc747087b6165be9af24ddd5273e8d3a521070
SSDEEP 12288:30yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:30MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T16BC4234360C69031FE1831F99E79A95ED0351E251E21D9FBF6807138BD76362A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ce0f734c86dda21ff31e1ad004a08135d9ef8c5afa26e9bb4048b9f2c852926e
MD5 af3665d379d81e8705a000ddf4fd7617
SHA1 b1f2720467f57d192d2e67497ea6d19301338a45
SHA512 80fed12c174c339dcc82ff51ca07369a765d40960e7973fcdfff22141670196a8a88961e820c7c98c12712f2cd2724b1eefd7454bab9e3fd05978a0db747aa57
SSDEEP 12288:dDyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:dDMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1F3C4234360C69031EE1831F99E79E95ED0351E261E21D9FBF6807138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 88eddcb6d852ba82c9086ecc6cf7ae3984dd5992e83cba1a770309061be5a8b2
MD5 4e4d8f9a21c369fa2baa263d48964161
SHA1 936c519a7c6b5d32c0ceee1b5fcfe42c0d4e6c29
SHA512 902ad75501c9adfceee13b0ba26731932e1cf072bd582437f24b69bc739f596bed3bd84bd5fdaa23b65ba0d8e76b44de244be4b2ed3eb6efbf9778794c4bf549
SSDEEP 12288:kByPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:kBMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T15BC4234360C69031EE1831F99E79A55ED0350E261E21E9FBF6C07138BD76362A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 72fe7d41beaa76ba47d405fff1cf74711bb793325e45fbb7d8e24e760e39d2a8
MD5 a9621185df28127e537effe9bfcfd021
SHA1 381959758f54f48210147fc77bd960c6d432f8d7
SHA512 322fc59dd2f145b19c4ae730daa7377737f2de734aa04bb8ca1b6960c8b4004b6f7ade8317f607400aa1bedc084d37118ec15beda052c468dde9004e05d234a2
SSDEEP 12288:uVyyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:HMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T11FD4234221CA50B1ED28B2F9CE79951EE1753D651B31EAFFE74021382D72351A8A4F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ce6c04ecc414dead95ab53a8cc7050f085cdb93737781607766517b8948b4957
MD5 741ca16f258014ed9ef65b0f2f73d57e
SHA1 a55dd85faa125b1b62ffc05d20be757f663b22db
SHA512 a0c7188a9495f7890353598c2316ee4b5c6a2690538365322da1252c550a88251037ede253ef67672efcc32fb9f7c2969e1be7328700e0cfa19e8bd5b7d5985f
SSDEEP 12288:EayPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:EaMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T128C4234360C69031FE1831F99E79A55ED0351E261E21E9FBF6847138BD76362A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 4cf836d3732f4c709abdaab24df78f85989ebe35262947135cb9639215b528ee
MD5 d0e540a1f9f98fedcd1e90ff5cc5ae1d
SHA1 913a155155baf467d263892ae0964633cb181b51
SHA512 282659f9691c39bae082b21d6e8c5ba8374e120b44dbcc70736df00469622030057f32f2c34b44cd54d29ff19f53712c895075539e2c9187f7af9d994544b49b
SSDEEP 12288:ufyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:ufMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T10CC4234360C69032EE1831F99E79E55ED0351E251E21D9FBF6847138BD76362A8C8E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a39843fadca92162972d0eee0dbe35d48b7655c6d2418bf1928b08af000af76a
MD5 1cf4b8974c484e6485aeca3c54b72a2f
SHA1 c7a79513c4f2ed71ae7379e58e2ef1b0010a7b6f
SHA512 fbd6e1861c1e859f30795d9305561e0381feaf6be7cad2c3325e617323a9cdc7e29ae9ef92fd0ef0f479553af4823a7303aadf4e4c39e18cbd617769ffea6a60
SSDEEP 12288:NryPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:NrMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T16CC4234360C69031EE1831F99E79E95ED0351E251E21D9FBF6847138BD76322A8C9E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 61fb774283592460ad0f810ad8c66f40b0285199c95030ed36719f2d2f443d17
MD5 1eb014c41b1353b87fbfc35ae2139551
SHA1 d8673dc73e10a98241a05f00ce271d7be1922d70
SHA512 5986214471dd9fdb88596b21a1e3783d49bacf0d8bd03e4efe9b93f128447857c2e46fc4456c81270dd21a333f876a8abf1b38a5d9e592c1dde7b3944dcb1acd
SSDEEP 24576:xZM3zFVSOjMWuGMF36YKN4B1Jdi5hbKFlkJtx:xZM3zfvxu37BvdebQKl
TLSH
T19D050295739018F4EC67817ECD65990AD2B27C1A0B70C66F13E4362A5F333A15C2EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 12987bf9131525e81426eecb18765d23596447b6c47a934085ac3b8143c0bfa7
MD5 651dcc85c11cbb9207c0434247e790dd
SHA1 f20a1e71089c9175244bc582c7121624c0e7cf1c
SHA512 1cf1b27e3ef4279abdd32af83d272cb1fb3d4180862b262519f15714fe860cec53275912f88acea43a95ebc41bc641fe961ae2ede9c82205cb9067a710dcc12f
SSDEEP 12288:9YyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:9YMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T10BC4234360C69031FE1831F99E79E95ED4351E251E21E9FBE6847138BD76322A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9fab36926464d8190d9420ec8348db8ce2b765e91f62249c4676b7a383652814
MD5 22e04423817d6a1a7c91a293154db2f3
SHA1 6d2cd90784cf7fb92a5c455d727cbef532e7e660
SHA512 e3bbbc18871a5b8e6237996fc56e65fd088170a93e94f56d29747dd1f3ac9e1836fcd0722fe502dd890d306822976406b0521504ebcb9b6fae4bf42876592e66
SSDEEP 12288:JMyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:JMMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1A3C4234360C69031FE1831F99E79E95ED4351E251E21E9FBE68471387D76322A8C8E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 26dcf218bccaf95affa8a373d1d820e8fc1efd1061a37dc621bb7089606df3d1
MD5 cea536a3eae71ac73a79b4612c608b02
SHA1 d9ef7d1f5e108c68eca0995172c2757ec6991c45
SHA512 fac061c79f50e34c05d9ab6b9bf205ee8a0737e5d34623468b11dc04cd79a33947ac2f88bc42444dbfa1b9d1ef9f2eefbdbdc9ee7f2fa02578b56afe3923ec73
SSDEEP 12288:IYyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:IYMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T162C4234360C69031FE1831F99E79995ED4351E261E21E9FBE6847138BD76322A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9a2a30f6e589e243fec76b05130c61f6c9243e46dca230aa82231e64e543119d
MD5 833f8e0ed2489fc308d3dd11d407e582
SHA1 7a2a306c71ce8361586712cb184f794dd60ed16b
SHA512 5f8668ce0bb39d293da43f5204d515bb7af9289f8c23efce3c591ab630250233e76b30e7d83022496eef8545dcb98eb8f06fbb33eb61e65540d3c0cbcf8986d9
SSDEEP 12288:+YyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:+YMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1C8C4234360C69031FE1831F99E79995ED4351E261E21E9FBF6847138BD76322A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0dace0f6ff7c69d58208bd6df2dfc7c69d34a7e45b60e928a565e00a2222b823
MD5 8948847ebdd69958c2cdf5818719f5f4
SHA1 3ae5b0f30bc08b83cbcea4682ebb60c31708b669
SHA512 89b9a99569166efccfd91de2d853dce907163d6426eebb8f388a98bd46926712015566e0d06cbdc148609327558f3ede1e2a8988f329302eb2bea45f6fa72950
SSDEEP 12288:OyPz5L8XyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:TzyXMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T197F40243729530F9D52652B9CD665A06F3727C320B208AFF53A0137A2E373A19D7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 5c79735806655eee20706fe2af33dc5f4623b6e63f82103247084e368407bd87
MD5 d12556dc1166d3e8c0ca65e42f733a4e
SHA1 4b656ffba5289b26fb679278a165aece077b38eb
SHA512 ea5e444574c87aa0dc857c3440437e486a77f1dc1e3f2cd78cfc6ea65717a36299181239f5492f16ae37e2895150743934d5c35944caaee5baa25badbe3a6549
SSDEEP 24576:PT8aLl3z0zDxMWuGMF36YKN4B1Jdi5hbKFlkJtx:PT7Lljexu37BvdebQKl
TLSH
T11C050295B39018F8EC67517ECD25890AD2B27C1A0B70CA6F13E4366A5F333A15C2DF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 9193f15c7c611d1a8a37619248388e3e01a0015c0f1f48b7d431168bbddca145
MD5 bc637c9dc3b3de88ae71ad3265c781c7
SHA1 4a46c6a4d4a0a749a1dc8b0da94abca409c919fa
SHA512 9d33ad3a2099bb4bdc50513ef223dc148dc48dee4241c65279c3589464f1e688e40a57eb1ef8c600b37ee31d7a3fc4d32c8936ea445e8b4593843869c29111d0
SSDEEP 24576:83rd9CHKy7GZNMWuGMF36YKN4B1Jdi5hbKFlkJtx:mrd9CHKyavxu37BvdebQKl
TLSH
T13525CE90B3E410E8F0B79A758D769512DA767C5A1B31DE8F03A4262A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8d858ce2e076bb1b1f810ad00b6c2b33b60d37ad2b435de593334949d7a46263
MD5 3c2e7bbb4fedfc2abcd63322eca5b165
SHA1 7a6103cda6d71cfb2278a87ae85fec93c6b88958
SHA512 c4680dc18a75c06e2394a236c49fc67be223ba4a07642b07d88b295de0dba814042d810ea9c102a77c3c399e6c5a1ce4c943fa20d61d22adac290c564433bf05
SSDEEP 12288:/hyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:/hMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T11CC4234360CA9031FE1831F99E39A55ED0351E261E21D9FBF6847138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 804b971fb1218913c1ba040e8c20406f07cd8737125e154eb5531402b00d4831
MD5 41d108e9b526c74a78612fb1a1d6a1ef
SHA1 bc99e5ef077e9f32ffec6799da12a1a3f5bd3684
SHA512 62e7dbd912b0698120775aecefd2df321c83d82c6151c3315d541836946b0be3152d92d12f54757a430d246cde0c8c0f63b4ebc1b9194df0234ab6b1ee49e423
SSDEEP 12288:s3yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:s3MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T125C4234260C69032FE1831F99E79DA5ED4351E251E21D9FBF68071387D7A322A8C5E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 85064d40702289a7428efde8eaebc44724fbc171c56d73dbc43280ac0ab2910b
MD5 810eac5504ee0644a39187404652234b
SHA1 9caf96190b36339e9e04d928dbc19c9881d50ace
SHA512 c7675a6519341d8b6770918eb380b877dfbbc509746c61170c5749ae928f133cdb4777d3c3a74d5c80083edd000032857e298f64202a2964a64ac5c5f5826933
SSDEEP 12288:HpsfIyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:oIMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1AEE4F10AD28801E8D46E62B9CB669A45F3333C2547E1D3DBA2C0F53D1F766909DE9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 802a01dd35bc4f4d48de6a165422b6cdecbe536681ba48475fefc9f4b4b4b0ed
MD5 c62a1a7dd212972d94ac8cafd9a797cd
SHA1 52c0fa228f0926eca92c582813a855ee05916892
SHA512 00ecdaaaacb7842afc32dd3c152e8bd6686469bdbc72f0661423c422f870570460837c5a5a91352bf993bed418768dbba944010955809348098c72a5c016da40
SSDEEP 12288:FXyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:FXMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T122D4235261C9A036FE2836F55E39D52D913A2E240F20D9FBF58072386C76662EC94F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 176a8fa909a9ef9a7d673a0f8c89d5349bd5d82faf3934644245c20369cb1dee
MD5 edf601a684c849c64a041c30e3e6e398
SHA1 5246d3044fb9a1a07b8d923e4a31d701aba094b2
SHA512 8455fbfcbfeaf8fa6fc2a7695172d8f5bfbb5a229e683adc1d068028d2eeba9a4e0bb230d57220f95e1c262fa71da75e338be78e7a4e15c001a9e157835e33c2
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQxxu37BvdebQKl:5a0hNYG4JwRv8Ll
TLSH
T18785AF1E67DC82B5D0BAD278C9A6854BE6B2B4260B3156CF1190853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 f3a7eabac739377b70c3155a8cb54d1d33393fc81d653636f9efa8fa03a55b1e
MD5 41ded7138d6cda491536499527e51d88
SHA1 c3853ac94459e223bdb3fc7499afca5ab1bca683
SHA512 17d2139d0f99aa746fc9c0440e1ef60dfb4ad37587ba38bfa9a5339fb8616c750aacd9f8f4c89d10b5fc670dc3bc652b4d9202c59bdff0baa538eec6d4d2ea6e
SSDEEP 12288:UhbHjfXwyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:UhbHjPwMWuGMF36YKN4B1Jdi5hbKFlkl
TLSH
T121E4126E22DC20A5F535A1BD8A65850AD331BC250B21A7FF63C0927C5F3BAE15C39F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9f7f6c334810f5a84be3c560b2b8ca2ae76e14855061020a575c1feca6078a3f
MD5 28b777b862eb2b89da53017525a68d8c
SHA1 ff691a44abcb9c9cc33561a803ab47f9e7a0ba18
SHA512 a2fa3f19a04cb1f89fc6f1b5d7f6e9b2fe9bc63483c333a1214863d9b50421c1ed8ef3254a4ff48dd76cd337da17ced321323ef3b3a13a322d5301a2b848c3c4
SSDEEP 24576:a3YgnJcRTk4yti+R5dBR/IMWuGMF36YKN4B1Jdi5hbKFlkJtx:aIgnaTk46pBR/Ixu37BvdebQKl
TLSH
T14B45B02EF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 9ec074e4b023af60c7a6007f753d8fa5e55bb5b081376b22cfb7e1e9b8f346ca
MD5 84b471942674d31edcb583dabb152edf
SHA1 0df016c479449dc7fbaf2e9c9999e9f67fd9e458
SHA512 12d1ac1ae3a3743626a87159dba324a96662ab02e49c1431f7665bce98ea42043b054a083ee9f36bc3065b3ed26f0e7d2cc6027800038e1dc867f21eb1e16db8
SSDEEP 12288:STyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:STMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1ACC4238260C6A035EE2832F99E79D51E90351E210F2199FBE59071387D767E3A8E4E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 b0353c2bb0b9ed6c431c33c77a072fffb2e4fa484847555a468d8dc99f8fdf15
MD5 14a95fde04264a67e3d14e309f51546d
SHA1 abb4fbb17c1b4501d74ca0b418cbf604042d8170
SHA512 4cd38442bde4278b740c542557fd60324420a38b745aaa53fefb20a600df0460204af5f171d8aaac38f7a4695d02a77797aee5169b5548fcd076b249eb0107dc
SSDEEP 24576:YAL3UTuMWuGMF36YKN4B1Jdi5hbKFlkJtx:YAL3UKxu37BvdebQKl
TLSH
T1BE25F155F69400F9ED6B917CC9768A16D272785D0720E7EF03A84B691F233E28E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 5b79958a5a9b8dc2cbe91a2faa44684fa9b6323f1ea9a6aca0ae0b190842a0e7
MD5 65eea4eaf6d7360b231c6ae48d634c05
SHA1 26a51dcda2911eecf326d2a1131add1c48603c5b
SHA512 8e7e1850fc45222bbce199c8d86e46a14e1fe24955c51278a42332983570b902af10698af7aea5571bb3bd67f8e55dd9f5d410db3edd15595633d687a91b979b
SSDEEP 12288:6pFtvOqyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:+OqMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T18BE4021A32DD10F5E539A1BD8AA6820ED3717C220B2197EF42D0817D5F63BF4AC79B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c2eceb8a944b06172887d3c0320cf2d489cb597bf723916cbd41275899e01f03
MD5 c615a81f87ef028fabffc273016bd743
SHA1 377568af5e5878db0f46534c7fdae915db5d44e8
SHA512 847899f735f09fd57fba560162d133d37a0881c742c4c3ac5b2e178075ba7e9d24c5ce46577696c3c6886fc863cde338c119fec0e28fab71649200dee42b7c84
SSDEEP 24576:v7NM9YqZqmWMUkPjZM48Mv6bEhsHMWuGMF36YKN4B1Jdi5hbKFlkJtx:v7cBWMpPjN8DbEhcxu37BvdebQKl
TLSH
T1DB65AE2E6BEC81E5D476D13DC9A28206F2B1B8611B318ADF5152833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 34c84e09a60a3c1160e792714da40b41e2281131febb71ec7919bd72cc0ecd76
MD5 8ebceb04e0ce29e6ff0c868a5a5ab4e8
SHA1 ebb6a1e9fb4ca7fc0978d1e0bba32e6882f6178b
SHA512 4a629e3fc556c79f3de8eaf0b7ae840416ebd9341586fb3b22688434741e172b0c01567a0167016fa506245873527f94cb6bb85dd0821d22a177f9b254d9f626
SSDEEP 49152:VF2YuHNETovAvNYf8kmnxu37BvdebQKl:w6BCf8k3v8Ll
TLSH
T199858E2927ED80A4E0BBD2BD45B7D246FAB2B8511B3055CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7f487a06170f0f023d6dd0506534e3299a2a833e5ccde65ff97e88e096d53a35
MD5 4afc3f3e3836166c86f0f513a75fd66f
SHA1 3ca1599a9bcd886b4b2a32ec09b82537e0119ee9
SHA512 5b9c1977a7d6bbfde4c601a11b05c942ff188ba0b6abc634dc278be4c03cced9074fe36c09a9023c0a71990f584e2070cc6f16db4980be9f52e8bafa06ba0639
SSDEEP 24576:fAFs06+Omlf8NXEbToGMWuGMF36YKN4B1Jdi5hbKFlkJtx:oFs060loXuRxu37BvdebQKl
TLSH
T1F465BF2F62EC00D5D47ED17D8A97C91AF6B1746307215ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 e8db6c878956722a6b97e73a9d02e982ad4d413d0952f2e435016e36606efd82
MD5 968e1986c95e5eeb3588ebae6516dd60
SHA1 f22aa437624ea7a2b4d1dc8071a8a779eaa9ccd0
SHA512 9b2bc7c22760871f1239205cb6f76274f14c9a06627ffe4762b6417cfc13847edf2b4b36dd76cd17b7c8679881de6e114997a4ad77321095bd209c772daaceef
SSDEEP 24576:GJnJ5D3WXRMWuGMF36YKN4B1Jdi5hbKFlkJtx:GJnJ5DGXRxu37BvdebQKl
TLSH
T14615D02DD2A810F4D4B7D2B4815A1B56FE72383D2F2269C728B4D5353F12EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ae2b01c3733f83fa65d584b928589ccb2642ad9055dd99e1df63d985d1957509
MD5 0de054634dd4268973230f5e4d22cbc3
SHA1 3bcb1783f1dcd4299a5799b0b1f623bbaffe48a2
SHA512 d132c8c77412ffb4dc47fed4587ca37ffbad5f13e68b23ec39818078ab6a7410f848acf48b7036928a4257e355aa3733a57c3d4b2195ac0203fa4855582e0718
SSDEEP 49152:hg06DIKdwc+eQnSt65aVrxu37BvdebQKl:qKv8Ll
TLSH
T178955B16B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 52df0aae032cc361ce5c1053791dc6af75e0ca2b2a1ca42980c20416fd04a178
MD5 4035411455f80758cf570ae348faecd1
SHA1 63d2ef357a4af4c8c3eabf6fc0ee2a336c322512
SHA512 ee2852671b2a464f9a6f4c7f040bb5d7545f1be2f0adcde759ae9c83ba01602148cce48f4263f668a2ec42b86c9bb8b3de66fa1400b7ec18204b773a39d4b010
SSDEEP 12288:DEP3RnxyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:InxMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T190E4125E229D70B5D529A1BD89A18609D372F8301B2267FF52D0D23C4E37AE66D3CF06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 1a4fe2375ffbd18653078f0884e24dabc1192ebf898eb0767d129a1b9b86e947
MD5 0098714372e08d346c98b8727f42d93d
SHA1 bae0ad394da6bec26907aa9fcf0c70030740dc21
SHA512 bae01d14bf7668324dfb59676cf403d48f5b8b3e7e4eb7cf5dcba1bdfde283f8f43e2d1840722d7cf7a4c40b31662cff2df125bec1f0cbd816116dbb58a9f150
SSDEEP 12288:CjkyMyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:CIyMMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T130F4120163C8A0B5EA7912B89E7781599A357C301F2196EFA1C0F23D6E377D1AC74F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 016be1f037f4af8f5d006da844f8253b74b5c08d912d4fbfc94879cb5ae72575
MD5 23230395dedee3df2e060ccbb5df6782
SHA1 c6156c1b296b315528adbe70f1eb7d338e8e4a03
SHA512 211499c7188b4e907a9ecea254c95cbdfb967126d70971fff036174a589829e17f53d1d818f1dcdbaf85c0c1c5c86b9b70b4f7537833e2d12d4386735f0310c5
SSDEEP 12288:ty6yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:M6MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1FFD4234621C6B035EE1831F99E399A5E91313D350F20A9FFA5D0B138AD763D2A4E5E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 540dff268c46c077fdc014e473570f14672bf6d7a59169980b48c0dd9066c353
MD5 8b6feecf6501d9a5ecfae4d8f8430f2c
SHA1 0422ee74094305a703f947343fa312088e4a9518
SHA512 49ae649dfb0a35cd232347724263bdf90d373bdf0202ed489bc87f45527294cbd9fad3bb2718ebfb51833824dc84cc44cd6503507031eef18ffd55770b4d855f
SSDEEP 24576:qQ9MxZKdcz9dw3/MWuGMF36YKN4B1Jdi5hbKFlkJtx:qVKZ/xu37BvdebQKl
TLSH
T165558C2DABE9059AE177D27995A250C3A633B4301B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 05ada4fa3b079f9695e4b60c03aaf03d78f17eed4845c0f5c3af09ab9afd3809
MD5 8a5988b80bb520b5e6134bf79b5e5381
SHA1 86124eebdba17377e6a0b3b73772e50af99444b0
SHA512 377b10cd6383aa8b010f111fcedb0e991d7998b8399dc239b474f3d4acf79d42dbb1fe70518639c1b417ef96d01c0962edf47b41f29bde207993c2adb103f688
SSDEEP 24576:YyocDAp4MWuGMF36YKN4B1Jdi5hbKFlkJtx:1ocDAp4xu37BvdebQKl
TLSH
T1DBF4F01FB7AE40A2E136913C89858749E773B4301B2257DB6591C33D8E37AE9BD34B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9ffbc7aaa7f57b057cd874100eff50779cbb79ccbea228036f8ad7b52272ac53
MD5 78147301024be5843badd953fa04d661
SHA1 2cef3fff56dc1c2374c77769c49319c5e8b387de
SHA512 5db003c7b9227ccf34d9cf62aed611e898eb05abc4dc32a118a12e65f939a23d7c99e9b648f4fcd6cdd527f94753407af63bd5503957988046df3805d34bf424
SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK4xu37BvdebQKl:a0zuNIzv8Ll
TLSH
T1E7A57B3DA2EC00A8D9AAC375C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29908c23f9bf78893f85e82467f3d30873c7619e9fb5e91f710ad4e6d14d8b08
MD5 f0a9502c4de8b6f08e4af6d0b28653f9
SHA1 39576bc359e7da19e49b527e7216a92ddb6f89be
SHA512 3de6ca25ede2b83e3042da078dff2bcd7a1214d21a5f0654d7e5cb160e3c6e158c3d949c67decda8de9280d770fba851d5576382d4599d906866306c518a8994
SSDEEP 24576:h1QT7EcpfxR+N5AWAz3ooiYzjMqbxMWuGMF36YKN4B1Jdi5hbKFlkJtx:kTDxR+N5YzTBjMOxu37BvdebQKl
TLSH
T1AB55B02EA7F815E9D17E85798A23C506FA727821033193CF42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-37-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/628-32-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/628-2-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/628-0-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/628-9-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/924-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/924-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/924-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1088-298-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1088-300-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1100-393-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1100-272-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1100-280-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1100-278-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1108-319-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1108-399-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1108-265-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1808-302-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1808-234-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2744-284-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2744-291-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2744-396-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2744-285-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2796-392-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2796-269-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3056-262-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3056-314-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3128-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3128-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3604-245-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3604-238-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3604-306-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3604-239-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3916-417-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3916-303-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4156-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4156-224-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4220-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4220-62-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4220-51-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4220-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4220-58-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4480-431-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-424-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-441-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-443-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-442-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-444-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-439-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-440-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-438-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-437-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-436-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-435-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-419-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-420-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-421-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-422-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-423-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-425-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-426-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-427-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-428-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-401-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-402-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-403-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-406-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-405-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-404-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-414-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-416-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-415-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-413-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-412-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-411-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-410-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-409-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-408-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-407-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-429-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-430-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-434-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-433-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4480-432-0x0000022E33F90000-0x0000022E33FA0000-memory.dmp

Download

memory/4636-451-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4636-311-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4736-320-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4736-503-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4736-390-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4736-397-0x000000000C990000-0x000000000C998000-memory.dmp

Download

memory/4736-356-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4736-340-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5064-400-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/5064-295-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/5084-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5084-67-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/5084-226-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5084-73-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/5440-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5440-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5440-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5440-40-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5732-307-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5732-418-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5816-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5816-253-0x00000000006F0000-0x0000000000756000-memory.dmp

Download

memory/5816-258-0x00000000006F0000-0x0000000000756000-memory.dmp

Download

memory/5816-252-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6052-315-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/6052-500-0x0000000140000000-0x00000001400C6000-memory.dmp

Download