898a2e03844bbe934a90ded2417315a0cfba1328d4ab559ef8bf9975cafe1b02

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260809-te77natydz
SHA256 898a2e03844bbe934a90ded2417315a0cfba1328d4ab559ef8bf9975cafe1b02
MD5 c8b2fbd462433df8669bb1afa9dcf9fd
SHA1 c444c3ffc6cde89858c03c2ac41baa84b2df8fd4
SHA512 fe8c27713dda124e86876d6e1e378354d795867199e8dc920b3102e580d506812f081fb82218b29a00767c784cb46aad549e1a1828fd412d138a5ee23d227f3a
SSDEEP 49152:F7mZ5UxCNBjHYi3ScakzEOyq+VPRT7uGAc9e7ao1d8bSTJGJCYtuLNiXicJFFRGN:RO2sGJeDF7wRGpj3
TLSH
T10E167B07A7B940F5C0BBD13D8A579657FAB2785A877197CB43A0861A1F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2012	alg.exe
872	DiagnosticsHub.StandardCollector.Service.exe
3832	elevation_service.exe
2096	elevation_service.exe
2496	maintenanceservice.exe
4140	OSE.EXE
1204	fxssvc.exe
1552	msdtc.exe
4224	PerceptionSimulationService.exe
4108	perfhost.exe
4568	locator.exe
4208	SensorDataService.exe
2320	snmptrap.exe
5116	spectrum.exe
2752	ssh-agent.exe
2992	TieringEngineService.exe
3988	AgentService.exe
996	vds.exe
1456	vssvc.exe
2748	wbengine.exe
1776	WmiApSrv.exe
3928	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5db5c53e905883c7.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e51a24c1828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cd3424c1828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070e4554c1828dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001da7984c1828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007236264c1828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e76f404c1828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6491a4c1828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
872	DiagnosticsHub.StandardCollector.Service.exe
872	DiagnosticsHub.StandardCollector.Service.exe
872	DiagnosticsHub.StandardCollector.Service.exe
872	DiagnosticsHub.StandardCollector.Service.exe
872	DiagnosticsHub.StandardCollector.Service.exe
872	DiagnosticsHub.StandardCollector.Service.exe
3832	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2216	2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	872	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3832	elevation_service.exe
Token: SeAuditPrivilege	1204	fxssvc.exe
Token: SeRestorePrivilege	2992	TieringEngineService.exe
Token: SeManageVolumePrivilege	2992	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3988	AgentService.exe
Token: SeBackupPrivilege	1456	vssvc.exe
Token: SeRestorePrivilege	1456	vssvc.exe
Token: SeAuditPrivilege	1456	vssvc.exe
Token: SeBackupPrivilege	2748	wbengine.exe
Token: SeRestorePrivilege	2748	wbengine.exe
Token: SeSecurityPrivilege	2748	wbengine.exe
Token: 33	3928	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe
Token: SeDebugPrivilege	3832	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 668	3928	SearchIndexer.exe	119
PID 3928 wrote to memory of 880	3928	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c8b2fbd462433df8669bb1afa9dcf9fd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2012

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2096

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2496

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3940

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4108

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4208

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2320

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2284

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1776

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:668
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dbb796aa151922fc1298736d3beaf985436d9db655d1e4d80436c6251d2ebc73
MD5 baaa61fb739b4c360ab7abbd327f3940
SHA1 59b0d29cf0b3a3160c8aa30af1dd394f96c5566d
SHA512 f3c597c42a9babe5c1ca5936a686965b83ecaf9bb999caa7c522293eac318e68f4ccea1dadc43159b2989f4e1b76dee8770ae2caf2e38e4841a19dd707e2cc49
SSDEEP 49152:ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnALNiXicJFFRGNzj3:C3q6mjBr7wRGpj3
TLSH
T131D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 832d39e5c49419bf48f2f6af9e2cbe64cf1cc490316f9c2797d2f92a9a7b461f
MD5 732073dca6fccaa08cfdfb70344a260e
SHA1 70e53b574a290bc70c51d5252460f9eb5bf6b834
SHA512 81b186f625e2aa0d864632ea8341f4d62f1e0effcf25b73c643a0346863bb4a2b1c77ed3223fd7467301a9409afc5708657f731ed593a934b2b9e13b83b3c7fc
SSDEEP 24576:yXYfDtczA//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZtcaLNiXicJFFRGNzj3
TLSH
T1DB75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3cbd6891c5ed2ba1f4c9e5c1cc5333dc410bff3d14c1788be372414fe9bcf896
MD5 e9f5d014a2c0bc10d2a27506e225aad9
SHA1 2efee05b89dc4cf8341c74ef6c37dd851ae4d612
SHA512 eff02b4ef2279387a1c2e386f69061d355995be3becae8a3b1f9c7a1f5a6106537c47e8ede5e6965ba427c98e413dc6c0b009ad27f94581b2fb3d79bb1e2fc39
SSDEEP 24576:L0Le5ji0hmxhrM4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LPji0Az1LNiXicJFFRGNzj3
TLSH
T172859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d2007c0d281c0cfdba66e29fca96fe4f25529c9120b0c6419198f3341eac72af
MD5 ced7f0185f33152599c3991ededb169b
SHA1 608519b8d2605cccaaa76873190e08686213e59f
SHA512 314877842582ac465eb6169543341e54ce3d60da2812a160865a7ebad3c7f68150417367d55ae9c92c966a2c76da081525173d78cf1680ee37453d5de4a146b6
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWj6q8wyuq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:T/ezSC6vUzPv+HjyZLNiXicJFFRGNzj3
TLSH
T149756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b1db761728e047c485957d6b7199536a883f7652ce1469d06254ef9c337efb0e
MD5 58adfe594954371f5b15eeb70e1774db
SHA1 6cd8586946723180d6ef1fa29356188632f73ed3
SHA512 a0d1c08a30c6ac6d035df37bf08a3b0b020c8234b78324dd7919762ea8f80026c4f4ed28443435d3be021c0c77edefe82d924ea1169b72e18da750272e1156eb
SSDEEP 24576:lVbqPb88hv/l+B7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lVO88hXl+VLNiXicJFFRGNzj3
TLSH
T14F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 92f7516756e7a29976c19eef9552f54b9e4dee1d57b104b1664363aecfbb2198
MD5 aff43bbe5c13979e1e8ace0493c8016a
SHA1 d870831cb1c8231f5f6e3d2d59aaf138215abbbe
SHA512 385ac9283e770e377500aa6b6441758b800e5fc5ee333fe78c038a167f52ab6d13c2f3d65b3be0c3531f9a5104c0488c65ba097aa745587a3f62c520939d98ec
SSDEEP 24576:3GE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VLNiXicJFFRGNzj3
TLSH
T1B85523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f08d7d4da621cf405074723ea04d01daa94188f257d9529f5abbaba0b39a7040
MD5 1bf42fc3084a984baebeb959d2d2f923
SHA1 a69514ee4a2fe26288001f4052084c7a2acc9e5a
SHA512 03a30023e0ef4ceb069fde32abadfe32ab8fd81778936d2b7c6f52c911b4313b9e84254198a1d83823b328093905a61675573de5bf4b81da212fe72d47cf67fb
SSDEEP 24576:zJIUT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zJIUTLNiXicJFFRGNzj3
TLSH
T1D975CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c1df59faae6b98db3df51fde6253fbcd3377de17925d251c02e62902201ecda7
MD5 05cb716399933890361f1c6817279c7d
SHA1 e8f1a48a3def69e91378a3323c9fe5a3f782cc3c
SHA512 1c791388c75c5c2623c9680a56bbaf78dbb2f7d9cb72cccccfc1f4772283107823b90278df5bd8e10bb74447e7a1fd7949cd5c3444e3ec04260ddc2949049afa
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THH:bQvGAdlCEL8c/WRNw5C67wRGpj3
TLSH
T1DD266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 31eafd289fc7541a80b5898ee5036cb6e5b02c43044b3d88dfcd4bea2eff7fc5
MD5 413c4a87827a2e86ed6bf16b4e14423b
SHA1 54368cc14bb2283f29cd72366e59f775cb45a9b7
SHA512 ae5ccb1bb9cc85e264a79e30ed8ccd39236eff41f3301a4da75fea20a8893d94a90bc981cc9e00c9a7c162af05df9ae0551b430342bd7c0baced3e3ef17dba62
SSDEEP 24576:PfewsAjF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XljFLNiXicJFFRGNzj3
TLSH
T1E575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 18c69fa0493e8958b66b032b9c9853ab25e7069274cbd80a79720b17b04ebf4a
MD5 619304044ce82c8c1a04d73301f5fe4c
SHA1 cc1b760cd90cc7b111fb80a1f5ebf9a79f105d89
SHA512 ec3b7fc6524dc863a4f598da856d7915f53081e32f0211576f5d9cc645e2a17b4a6ed78e165af0c9cdabbcae0956b2b2677d3b21537eebae4e05c72f148a1888
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHxF9:RUEtQevvqc2W1cpV20I32n9
TLSH
T146474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 711cbaa61eec0654c1468000b40983fc34066d19e840f524acb5bac0eac4b78f
MD5 14dda00661d2f1bdd0a8201b48acd05c
SHA1 a38ae2623176fe800e79bc0b6bdf757b3c9493eb
SHA512 8675b09939e5d335471dbcda0618dc428873d0355135e8343a488d9810caa530d473f0077aadbd47f831295983cf1b27f4e385b0e0d32c34b973bd88426c669d
SSDEEP 49152:VCbRquA/m2yL5zLfFiV+XenmE3/zlLNiXicJFFRGNzj3:Coq2Vjnme7wRGpj3
TLSH
T16BD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4a16ed647739092cc448096ac55faecd4276132319a661c9abcdef9402ad0898
MD5 c63d70f69a5520c143f5b3ab8f689c34
SHA1 f57303fba20a2727ea65c6ccb332a3eb0003c01a
SHA512 aecc3913d5ea8cf26d5522309f1bde66ab3880d03eeb2978178e7aec31b0011ee640cd8f0cf5c0a86432e0ce74fd89a367a283c9e1043fd9d0ea5dcc5db98da1
SSDEEP 24576:kAhGL6IFoiwtA5l7S53+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kAM5Foiq5uLNiXicJFFRGNzj3
TLSH
T169359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 924b7b3689828faa93f2b5b36a51f015e217f22fc9b6c8f1fca96f0328973f5a
MD5 ec4474fa3ec9a0b48a97a10f6055ec02
SHA1 45a936bf7f58a3f6bd9b5ad9472b87e4f9b49ded
SHA512 ca599b783bf4452a11c8dcb39f46cece30d3dcc7cee25552c988c0c46c859635951546ec261a53bd36d6dc34f67e6d1fba47a4d03cca7e469345a539b8d07e96
SSDEEP 24576:rwuROW5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rwSOCLNiXicJFFRGNzj3
TLSH
T1D365F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1961824b37a1c1ed6d438c2a5b7110ea0b115e6a49b56ac7e625b1a3876db911
MD5 cb29e5bd54123ca8158f8871c442eb7e
SHA1 4b4f1e51eabdf62c1a4a6e482b3149b6ff8bb780
SHA512 100b7594b78a7af2e33279d5599057a4ab907599c422d1a720a574f6a3bf11ad8c99719036737af660ed2e315a71a1b4453728bc99f124e8d8bf19a5d4b6bc35
SSDEEP 24576:GZuQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ELNiXicJFFRGNzj3
TLSH
T15755129622C420F5E2BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f613c15e0861686b9f17b10f5d6978a7132b5dee9318473480ece9909f022206
MD5 f9d33dc007a6997a170e61f2ad35bd4c
SHA1 c5eceec4fe9b6da40e9dffaae25de4c374224e0d
SHA512 16a50e1fc16a1676069e19ee281c2ba7c8cf7da4793a5ed253a280a2cf66c633c47ca79218e697b72ca60b997a0a2f8d2b5ecffd4664ba14a121d7eacc587b52
SSDEEP 98304:OQRQyi36YOcPDLvw2gAf+PN337wRGpj3:VQyiKanX+PN7F9
TLSH
T190667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 54e3d2193268f0ef4efd1b13ba74ce58cc93ebfd3a666d3fe720eb6635b5916f
MD5 558e0aeea59a2a1371c851509e7d22ba
SHA1 c22e22ce802677a974c66de60a72cb316bafe40b
SHA512 3cda877f4c28d989f85cb8d51080be6975efa03ab888bad6bf02149c7d3608df4867fd7ef607241e11c75cfa7a6b42c81de4fbddfae7d115576fbe3d844d9635
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN337wRGpj3:9QyiKanX+PN7F9
TLSH
T154667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bb4db774b2c4cb3830369c9c173f11b687b378ab91f73e593aae0aa6d2b8b98a
MD5 e168c589d3316a19ef690f2f18f04331
SHA1 33a52896f71e95b1219c76efc0d9bc0964c7e083
SHA512 1908540d9261a2fc9bca4bb6707e18fb2f8d70264e9673c73ec265b51be92e0e39ef4b7d62fb3ad0efcba63587b38f3aede195fd3072407ea74b57d8873ec79a
SSDEEP 49152:L68Qg55nhkeWu7PNU3/1LNiXicJFFRGNzj3:VthTRc/17wRGpj3
TLSH
T1B0B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8584d01fbed0ff427dabb7f551f0e2fedb13f209a1df62daa05fc39f54a4c181
MD5 e41c9d73bae5ce4f880f52a42365122a
SHA1 2d739e86ddffd91d405b225ec9e02617f4ff719f
SHA512 2e407296170dd081006268fd0cd7bfb7bd77618070ad38e42b3ffa9fb22c432a4b199003f7b8f5df3e2bf195b7c63400833a737c07af83a5505f538eb60e459a
SSDEEP 98304:cy5112gYy5azzVvU69nLKnhZE7wRGpj3:dLIHRWhqF9
TLSH
T15B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 58e9decb3cf68040ef9c01bb38bd9f864173605571586c7a73065e9a6816a433
MD5 aaf4dbb87bc2f9bb713af8783314327b
SHA1 b37e168057d1e36adc4975df49ac974d6190d07a
SHA512 80d802d8ab8bf244d49a03b87ad39e56fc4c49969a9899e465669ec9ee9a5545dc9c866f3e65b410e95b692d479faa007b8c2a4452b0c2e844b70610340d1553
SSDEEP 49152:WB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glvLNiXicJFFRGNzj3:ku6JmIxd2dv7wRGpj3
TLSH
T128D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e4773070d92a72dbf30ddadf81cfaeb8fac2c904ecf9bfb8a942f4844a87ac02
MD5 34074c66092dc932761dc59effb32c79
SHA1 851932257850c16674bf52a9c0e05c57711a6166
SHA512 13db5cdeaa58aebec7121612fd2c58cde0c7e7dd6f19a7560d39ca080d644f2b66aaee84b0bdbac1c1fda7e9c2c9331d6b6b282ed11eb11c1a25f46886420349
SSDEEP 49152:t1hpsNoJpF1A67U44CwH7R4xzLNiXicJFFRGNzj3:tmifPqRe7wRGpj3
TLSH
T10DB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 81a8b8172eeb14b69d01e3f63c4cae661f3662a65ee379965fe88c56f57e0b42
MD5 c8b43e1e9ded7e9349530525e4b0d505
SHA1 ecb751885330cbf316697c06a4e3c13dca705ac2
SHA512 2fdf6d21d625be27d3cd1d75a8b425cefd652ce95f54f1c011424039e5add91dacfe2eeda4090dbc4188b45cfd4fe4cfc8092264877a5acca65c40d3b20e5cc5
SSDEEP 49152:vSuZQIY0Be2KkRVtOnks6NMHqQLNiXicJFFRGNzj3:V5dKqi61Q7wRGpj3
TLSH
T184C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3be9e51ae355d0cb887d2771e176b2c629c5cd8c02ee88095b6c6f3d21bbf4d6
MD5 4539e8e2e2d3df02db24a16c8b1d987d
SHA1 471c43000bd0d6886568a1a03122f584db598363
SHA512 5f7e2a97da4c4f1d87df106ce684f71ae8af1bc992f9e80cf51a9cf3e01b0a5cb47efe555032e15cc4cfbfd7452fd53d78b269ac77f181a21617bed4841d5ae6
SSDEEP 49152:fhtSn8EApI0figjgiDn0AP5w/LNiXicJFFRGNzj3:OX2iWphi7wRGpj3
TLSH
T15C95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ea54cd9d8a61d32008377f86b0bff4b326df55e2137180d3c9fba0407593e495
MD5 1065a33232b3654046193ec4ca0ead08
SHA1 d5dd9d70935c1b7f12949cae5de354f39d6e3d38
SHA512 7e5cff57b79e953f703b8fca006efd0013dcee4ec2db23bd5f97e9c546ca256d52c3774a4c8d0f63ecf09051bc60c840f29a483caf63bab7bc858850ac361a38
SSDEEP 12288:a6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ac/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3558955B1F6FC003AC6754428F5882E2DEB5618E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 df84c97349f74267b0fca10ba7cd0fce880f417da2507e9a5276fc20658f0000
MD5 a3ebcfd4ed7e601f68457665c7942fc1
SHA1 bf8813eac8f1a7b7dce9c6b97ab05e309d34df9c
SHA512 1cbcf0cd2c9a88d104e50fc96a7e754c3df01b0faab4528806f064d8bd22ade96ef39f6a768340e0d07fd85dfdeb7c8cefd5cf8408177df35bcb5fa8eaf2162c
SSDEEP 12288:D9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F15523D3548955B1E6BC003AC6754428F5882E2DEB5619E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c034b36c14e962795c0fa112a89167ae06a78e325c93fdf8ef9d00ed525cecb3
MD5 4e220684c43cbc1f8b7632479422490b
SHA1 73dbe70eebe1473de84ed8334e1e982ab316548c
SHA512 ce4916c3e1964a41ee382803b64641a8bf0921720d3f77ae81f25a4ce5287e25fa78fa9960ca900d0a7732ee379cc26beecc0329e47befb11bfec0187988617e
SSDEEP 12288:GfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1705523D3558955B1E6FC003A86764428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5926dcc33f5aa92d6d058f83b209e9c6b55b899a680f1d9b17e3d12e22950943
MD5 afa92a36caf9807e47a360ade25b3352
SHA1 de5384b4a3c13b2a12d6e2ec07adca812fa4caa9
SHA512 3dae40fbc29fa48307edf0b1ae45a6e0179c30f5ccd3c12253c154efdfe0d555e0b5db7d2731f2d6cb6cdd25a35a7e760508d224e1959ef8999413dd63089530
SSDEEP 12288:nV0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A552392168900F1E9FD8039C6764424F2A47D6CD7365AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ff440075ba9a46936eab830b5179f54a3dc888648eca50e3dca23a95d2d23eb4
MD5 a27e89bc686bde942caabeb8a77c3b08
SHA1 fcbe9bf3bb8db29516903a119a829083e8959513
SHA512 0578299da23f6972788e22511dbe37f134314a536636be613ccff526a159eb53cfcd601d911ffe91870cd7acc2712f73623b1535e8e76a4008652c386c33cc24
SSDEEP 12288:/ciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b80d68e86b2832852cdae07a9c5f8163101b0e64ae2e448ab8e7414fb88c88db
MD5 be7a2b71ddd85afb38b7ac707f49f6a9
SHA1 ca9009135966638e8d8affbdce2f80998f892d24
SHA512 b48ae8879c4da75b46037b47efe40822094e9ba9e583a0985591626af7dd483a8ec54d06958d6d4e3c6696c40869d8eb4caf920fff8ac57e8befd131726d7111
SSDEEP 12288:pRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D3558955B1E6BC003A86754428F5882E2DEB5618E3E2483D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c048aaeda35a44afad2ea61f0a1a114c1dd5791c1eeb916b13cae71bdbe7cc79
MD5 0a9385134e6e2d73321273a4ca468eca
SHA1 b54005b4bddeae60c8004bd9020e2308f3123671
SHA512 de51eec27fa7ab77a2633b16c835e46dd9c4541b483013001836b464852212dd3a0f20b40166fe17219cb17ce6ac76734a3c8af4e38dd00a113136e6b4a8ceec
SSDEEP 12288:MliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A5523D3558955B1E6BC003986354428F5882E2DEB6659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1d5d1c3232178648bd9b4ffa745292bdc37c39a5d127bfea319260f1dffe7c6e
MD5 3cb2adeade0eb7c7d4ac2b2bb2b4d2eb
SHA1 4bd95ffbdef0a42691a8c4ea01f4a891ff771cf5
SHA512 856a18a02da0b17f56921ae6714fc7eb0f2ea9d9b80680c57a354add75b88e3b6af2791d6b489cabac5f4b8d68a24c5211b1d7a772d09bda0dc3bbadbfaf0bae
SSDEEP 24576:FZM3zFVSOB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FZM3zftLNiXicJFFRGNzj3
TLSH
T13A750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 dbad8de838c93bf29f4c7c57b2c376405c7ad6abe51e1f243f9fa75125c15ad5
MD5 678be4958b0cfc9c7eafb4c38efb06a4
SHA1 2bc871e3ff7d96394fb7de0b6cfa81cf1075d863
SHA512 c2b9816d016b41ffad6987ffef2356eb90b3c4f232a239083f71db7ccc3aa91863e3a124db0a56b9d0beaddf7c3c8c777a4260487bbb0b39bda548ec9b048743
SSDEEP 12288:QWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1975523D3558955B1E6FC003A86764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cd6bf7b060bbe2010b704bc8244b0c860cc259ed96eac69b4251949b2fa5af1e
MD5 7c68fe2844bad5a3e03c01cb8e21d909
SHA1 b36f44efad3de023f6c80d7c1b0e5261b42d26e5
SHA512 31937536f63205d8ee2deb254f3d17be01ffb26846ecbe78af4321bce4db17b2594d4266dbf27256772f999a6efe82431db253d2696c97caaeb1da603f36d231
SSDEEP 12288:+yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1795523D3548955B1FABC003986754428F5886E2DEB5619E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 53817ceb743a22379554204f5d3d48c2f20dbf4b07521b1e9a59d4bffa40f9c3
MD5 f321fff23bbfc2adbe08fbb59658b04b
SHA1 46aadfdcab9f1cfcbfe0e38c367485380650aca3
SHA512 08e26941527c75ba89d79430a0fd5eb3ca337f6ffe4e25c52d97848d8831f38f76f3c21541e3cf06a33e8ebf4e8fb3cd929ca972f05fa1877ac4f78ed19ff27f
SSDEEP 24576:EzyV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EiLNiXicJFFRGNzj3
TLSH
T107650247729530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d340cd40cac7cd5c5c379ba56d7fcf243fcc64009318a401acd8f95f6a52157a
MD5 3ccd6336d071fa8d65e697d8e4af88ee
SHA1 89b6b70507cb373d35727fed95c0317cb2f8c170
SHA512 169ef2fb2fbc20ae1dd6ef912fde1cee532b1bb40676bae79c52d3fc319de8c67f955d9164a1c7ecef0c0ad056dbe22c62a336e4ff9fd6827334c0cea8e0e9b6
SSDEEP 24576:5g/TwSfVcYG3K/cJHlnFR+IGNe8j3IzP:iLNiXicJFFRGNzj3A
TLSH
T1795523D3548955B1EAFC003986754428F5881E2DEB5619E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ece70b373caba7f3419d4b9dc064df3412d923d1c79643d1c6362a6abe701387
MD5 d9f86d08d5aaeb1979663c89d298cc9b
SHA1 71f0ccfa0e64c7c7baafe3068fc561c16675769f
SHA512 d6a8c7cc10a805181266fab197362b453086ac00b325a92fbc39b765234f9dba00f3f76c083081296cfc2b22c5dc6c68c622763c81db9438e6a345615736e2a8
SSDEEP 12288:UWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ug/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3548955B1EAFC003A86754428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1c631102bfdc9481767f3ba459537f54b1a9f2ff42f6e477ee18687df33971f8
MD5 240b617b2c37c87ab59bfb64378aebb1
SHA1 27d9d89b98c9c7444aede78c2c7bcc1604c574e7
SHA512 49c9baa41cbcf8514f09c5726254fd6434915ffcbb25e3bfabc2e1ba7180491957d7295c90a5e4f6880c4e9565debcc8304f4b94b3a95bdf15a61a5274e12c0e
SSDEEP 24576:TzyV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TiLNiXicJFFRGNzj3
TLSH
T15A650147629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 03a8b9ef18de5b58b250a22fb8c6a26e994a1c14d2d7ddc13f65725857a1c378
MD5 a018a9333de3f49838b20fc469b7a912
SHA1 7ae6a0d582c491404743bcd384494e8491d0adf8
SHA512 deba6657423faeea95fb9cb9664cc25d91ba3ae919219f02b114177527001acf386c449482e991e265091c29bbf291ea9b6c7f5c16005fc64018a7af51608a4f
SSDEEP 24576:TT8aLl3z0zDb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TT7LljqLNiXicJFFRGNzj3
TLSH
T15D7502A5B39018F4EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5b4bb7dfe7f1de58808ffb2a16c7e102d1c3e3670f2d0b41aa76b1ad3b7aa619
MD5 43a9d94d07043f2d8b08e11ad55919f2
SHA1 97d2098a623c1396c078d1c4f69ddfff71cdba52
SHA512 b2f9c56fb176045b5f18683df470edf3fa2b1b8b74e6b51d2c2c2df9b493a374e629d8d96969983aea670cd704be42245d81d0df7f1cdf2c199bba9411301489
SSDEEP 24576:73rd9CHKy7GZX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:brd9CHKyatLNiXicJFFRGNzj3
TLSH
T18585CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7f2da4392ccb5cda6eb0064a0a5536b02b2506ab1a3429862ebb81bad0e68427
MD5 e99593f87cc9450d09856eac7aedcbb5
SHA1 8995e06b9cb0fbaabf512804a0f7fc77ca08660c
SHA512 57c86dd62721b21b6883b9e66bb04b9df2fe120d43b048266d174a5b01316a2d7110f36484ddaa41874df3fafc3f49c75b99239504b2c51b2d292a512a03be1e
SSDEEP 12288:R/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b3c10dbf0189cb4ee6ce394d33eb1e9c836096bddae38940ce645bcfed642a4c
MD5 d3ffd258af147e565bc140ef982ecf36
SHA1 026e542a61c424ead2e3b714d1ad214c2957af7b
SHA512 aba43987d74fd179333a9901426cdf683853c670b38a1608fdbfec6a2c29e529e6197e0d58ef4e4e511c306aac1c8715d69d1137cc8ca904e0d1279d55c8034d
SSDEEP 12288:gpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D2558955B1F6BC003986764428F5882E2DDB6619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5746d30af7bceb5123e9f7a59390114857b8093e3b8778ea19675cd356f9c18e
MD5 b7b5dcc2e00568a999346154d5aac6ba
SHA1 5ecbc8812161762e1b8ff1657f4ee9335628395c
SHA512 ef4a6a0406cb4003223e105888b9f0e8285f50c522408fd6b6dd6a32993b1ced090f59ef84cb75b27d2e5ce78d95609c47f1d02b32bbf80a57954bc49a79aee2
SSDEEP 12288:xgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A35523D3548955B1EAFC003986764428F5882E1DEB5619E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ca040481caee88894e7cc05a8adbc4a3e93be200076d30524c12968fdc3369a4
MD5 6f2fa6c340dc50efe6f82ca02bc36f91
SHA1 b927ee3a0f44c2204ca968c6e59c8f5212e6d8fa
SHA512 c667033f9dc36cabf07d6b13d5f0795aabd8b2f8c9f0c0bc80945d6d1caff421841c261ddff7274e5bf44f5ab13cf6bb4fbc65e53c56e89c886a8fbf8fce819e
SSDEEP 12288:LpsfmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15065F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c30207b9003dab8477e1d0feeac994c9be52cd9dc5126603a09b76ca252b70ae
MD5 2874bb5cda55fa2abb8ced246932a3f0
SHA1 2ae9b886c4c96eaeb74c6645a010e4db40a16966
SHA512 577b01b2a3fbd87cbf9be0e0a318c3d1deee7f8fc2fc1dbf8d0a3327dd2e18794d69df48341a210530915331f922255e83f6566ab18eec57905217ecbc2c891e
SSDEEP 12288:0KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F8552393528C55A2F6FD103986368438B5497E2CDF5599D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1ffa76f71ca806c035d65d57305ff754a2023bbf61e1ba687dfe9bf143dc5c1b
MD5 7ec559612aa2be8c6b3e1787e288e4c2
SHA1 94b0ca05b147e606fdba34d14ce4881c203f5a5e
SHA512 41752ad358be822d286ace6da9e8c954f7313a46b63727ef4f9cc8f626378babe030fb8c15ddeb089741246d88fee332529cdfa522332fea30374e1a70c391d9
SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQSLNiXicJFFRGNzj3:Ya0hNYG4JwN7wRGpj3
TLSH
T13A85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 408bda87f81e9c04542f7cada847142345dac9e56f2a67af9f9462a5467ae039
MD5 dadd3e86ba30e7e6cb903cc008603e75
SHA1 da5ad1b40f7121362818df5c74a5d4b9f2eb3e72
SHA512 9a236d1392a22e012a2286315757d7be09c679cd19461700d442eb7c14a94b7b20ce3f88b621b411edd92437580f851365fcea388fdd9a050645b1226a047172
SSDEEP 24576:5hbHjP8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5hbHjELNiXicJFFRGNzj3
TLSH
T1DA5512BE169C20E5F6B5903D85668409E370BC29172193EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1ef40e5ba18738712dee189fe9bc35a8c4fe1dc9199927a167690ee81219edd5
MD5 1e09669d628d6c84e808d33bd35f07fe
SHA1 45244a64d42bc6b8f500edc1c58bb7bbd7798f59
SHA512 b5f7425b5796b9b82d77b4e7f8d28420f0d5232c7dc66cc79c56175b5f67492434317695f82e04c82a2c7b3837e95454668a4448b8a92fc5cd9fa4379f9e78b8
SSDEEP 24576:N3YgnJcRTk4yti+R5dBR/5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NIgnaTk46pBR/5LNiXicJFFRGNzj3
TLSH
T15345B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 94a79156f35981d464390e82901e71488a9a20c7ff8cc0685560ccf8e8feddba
MD5 b3cc5eba0b6c49f87495f74d3d51eb91
SHA1 f1e697cf07b760a3971ef9dc93e90d94d348d98a
SHA512 3d85c635e1756e0d86fa7fd4d0889674c9f8c69babd8a5aa8d42b4d6f22694266bfae189df188be8aa3e1a6a53c4eacd720d927893924663677ed6190c0dfafd
SSDEEP 12288:c2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B85523D2518955B1EAFD003D86764428B5882F2C9B2619E3E1543E1EA27CFEFCF38167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 c31080ee1506f710ae162bfb9151a1f0089d7c4f2d8a5c5f7140135baf8a8096
MD5 e76bce5a66afccb212373977f52a5414
SHA1 c5cc55fe6731407c8ee829118f1c100eb1e8c56f
SHA512 7f8019e7f097745cccb86b18d68af859fe1fdfed885e34d8fde556d2197611d3d585f2173844e5e714372e2579e2c5cf4d5da8e18f2b5e8c1a277c1998e7ee9e
SSDEEP 24576:NAL3UTf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NAL3UjLNiXicJFFRGNzj3
TLSH
T131750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 8e88d7e68703e2a378558f48c2a1b9920fc669ca21deb9b74a6028d5cb8d2a7e
MD5 d61b1d221f4df738c1f9866084a7746f
SHA1 eed274c39001497bd52e5d272dcb18374b103bcd
SHA512 83fdb547182633593fc986c151dae37cc159c264140f955854256149a0682964867e02d4e23240ed0d8d23583daab945029fab8538e2bb0e6a70a37c13afc423
SSDEEP 24576:XOD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XODLNiXicJFFRGNzj3
TLSH
T12355126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 90240908a8e0fd48253988b0909453c3c1c5721dcf1efc739c0f583e34a4b24c
MD5 af7ffe92937f90374ffb215f5434d546
SHA1 0fe4a1301dffe57a00cf8425fdacc7f696b1c590
SHA512 bfdf51d6b6829eed72c7642030b427e87835f52d9e73cf83aecca96e5af02ee926acd6237271fec3da35fec94753431849a0509c11ac9d6a5814cad2b0d2bc45
SSDEEP 24576:+7NM9YqZqmWMUkPjZM48Mv6bEhsc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+7cBWMpPjN8DbEhRLNiXicJFFRGNzj3
TLSH
T15465AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8d9bc0b81b336779a5024481e22bf14c63b28b837bb5f54b705c1471be01847e
MD5 2e1ff35e437d62f705bd2efe1ae60cef
SHA1 fb4149701b4032eb2e391ede8eeb14e43483dffd
SHA512 3665c47d165c7c82f043c2e0285a0eaaaf742ea73683d0ce030233004fcc38f978756c2da99f01f27bd43569bda593d687bdd36c9ca62dbcaae643100e52c51a
SSDEEP 49152:BF2YuHNETovAvNYf8km8LNiXicJFFRGNzj3:E6BCf8kD7wRGpj3
TLSH
T162858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f9c2ccce671177573097fbbb0a605efdc9a706c9aa730080046bb655ad0a4870
MD5 99db9d7dccd3d301fb34d8e2a9e633da
SHA1 9f4fe4db4d04c4b809311254d12402dd40de321f
SHA512 5c55e331a79a5b1e6b74c6d739d75815ffe3aa66bbdbe424a8d2e8671a4bbf50003109937e4fb9799a9247ffe79b0ee2830162462107a19ecdbb53b68da2e77d
SSDEEP 24576:7AFs06+Omlf8NXEbToX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0Fs060loXuyLNiXicJFFRGNzj3
TLSH
T12965BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 519d934797b76e3ef282410ce1dbe09b3b853b3ddabdf348af902dea8103165b
MD5 8b969789c5305bc0f7029f75509d783f
SHA1 96d5b03050fd393215e3c5b0232b63ffb9bb2c92
SHA512 b7b5df1bdadd66968276b9a4957ad4a3e6750fb7ef15d8776399e0eacd8cfb5950fd60c3614634edb1024586237be0aa0e05e2909015dcb169cfcb3d6cf2ed51
SSDEEP 24576:eJnJ5D3WXy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJnJ5DGXyLNiXicJFFRGNzj3
TLSH
T18275D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 90652cca84a6286b97900a4646ea72d48a9f33f0fc195b01c43d0ead610a48d9
MD5 84e101aa9beebe55c978480a8ec9ab06
SHA1 da309b2a05cf2edb5455963073a459f0b0e7bf52
SHA512 717696207667aa0739ddb84674312e5c2de66479350201335115f32f3eaee057e7a1547814236530d89010e3497b0da5045e68ffa86cdb7eed50cd1e40b13789
SSDEEP 49152:xg06DIKdwc+eQnSt65aV4LNiXicJFFRGNzj3:6u7wRGpj3
TLSH
T11C956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6470d7ff06175c673764414947f079d33067124d0e4d6bb4ea2ae564a811b6f7
MD5 0657bd38915d22fa457af9435a8d729f
SHA1 dd8088da4468a009a9493923c9dc265ac07c2430
SHA512 6e52b118b6c3a62e48f9dd5794d7c4f924a7fa7c05a4101548593853cc623333a05dfdda76b512f2b273093a6dbfb3755c233f28e860d5cc60041b5cfac4ee86
SSDEEP 24576:pnb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pnbLNiXicJFFRGNzj3
TLSH
T1DD5512AE278C70E5D57A903D85A18504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 9baea85438d5f78eef3e14ca432241bb6062dc9e087be045432724e1aa301c30
MD5 3476362ed6c49e55888146d04c1355f5
SHA1 a3b0699d43085fe32bfa7cac3eb60f9fd0d9bbf6
SHA512 db5c9dbfac733efb53dc65ef582029890a11acb99a90591a7e6279c404389f4930e95618b9086b819a484e2f39145d22ca024f86da4f2cad009789058fe9db9a
SSDEEP 24576:iIyh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iICLNiXicJFFRGNzj3
TLSH
T18F65124553C860E5EAB9013CCA734064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a1c6d0ee2481334beb36240bf56d387d3b5f510122d96f9e14b20c354645fda4
MD5 890c65ad62d05ff87d70cfae0382b5e4
SHA1 21d2dc2811d234a72a0b3391c17126c82ed0a859
SHA512 7a3e9c8f13f5e3d40f7895f2803cbfac4d433f7052471b39c0f9a2dc1cb8757bf1b9d0d36a9ed74dc10bdd61b10b0c89af97c43db28e71db206a94d088bcbdab
SSDEEP 12288:5yHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1985523DA118964B1FABD003D86354824B1943E3C9B1628F7A1947A3ED339FDBDF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7e5bb760a6569412a00246425ca7b5610fd09ea6b515732df302fd07db2424ec
MD5 ee1d043ef8638ccfa43bfd00a4378496
SHA1 584b0e16abd572e3c1868d9109b44fe86d79aa54
SHA512 00588cbcb6076bd593b5d2cedebe52cf06c9261615a86d89e5181d4a24c3c96e4bec58288de5a7f5bd884ff64c71c1bdc52e7c6f6ecc641f88ffd5ee81e49cac
SSDEEP 24576:MQ9MxZKdcz9dw3U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MVKZULNiXicJFFRGNzj3
TLSH
T12C558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5e021a2fadf36cf6afb971ea770a99b1d42534937de565bb1d1c9a27d8566fd6
MD5 bb7b6a05a8c566faffb8d9f27d219d40
SHA1 1a024e48fada1cfcc9aa65f348b104051dd8034d
SHA512 fa90914b2cd900ee1445b4161646d485c37b03ac0774c0be2ca88c958a3ba4175492f92857d7c696dfdc2eb90309b52aff63910100a0cb122c08bdeb0e430de5
SSDEEP 24576:vyocDApl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qocDAplLNiXicJFFRGNzj3
TLSH
T1E665E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d79be83568cc18b0a74a7d0a0559e2036a67ae5380e5d363bd4071154bfba434
MD5 016ee729ce7a0af6bae86b9627e77b1b
SHA1 8d9fe9a5c7317baf2de73fe270f777f9df3f93a1
SHA512 0f896f70521c85c3c55399c015f6e679aad5e2dcee00ac0a9fcdc9b3ad5b2bdcbc67ebd528614e7e99b1f1f74f62a5bb5507ca941f5a0fc3544113a277c89c91
SSDEEP 49152:sWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKlLNiXicJFFRGNzj3:m0zuNIf7wRGpj3
TLSH
T185A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29b96158e79b5e7214c61abda5549e137fa8d409bc36000cc0b40cc5a8a77f2d
MD5 84b883d207ae0051335f54bdbb020157
SHA1 3bfb9c23b861b972b3f11082731a1ce9d4252698
SHA512 a278e7f3528aa5a91fec49ccf9e70e7572b5f4b334fd373a934e1c7b67f5c19b1ec32146d890d3368d6214c1c7d7b665c711f3aa5a7a2b7a187f62eb546895b5
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYzjMqbb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OTDxR+N5YzTBjMKLNiXicJFFRGNzj3
TLSH
T1DF55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-31-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/872-17-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/872-32-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/872-237-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/880-431-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-459-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-433-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-432-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-430-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-429-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-437-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-438-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-439-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-440-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-428-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-441-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-442-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-443-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-444-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-445-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-446-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-447-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-448-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-449-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-450-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-451-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-452-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-453-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-454-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-455-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-456-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-457-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-458-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-434-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-427-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-426-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-425-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-424-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-460-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-423-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-461-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-422-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-421-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-419-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/880-420-0x00000257D32C0000-0x00000257D32D0000-memory.dmp

Download

memory/996-436-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/996-321-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1204-252-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1204-247-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1456-325-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1456-485-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1552-251-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1552-320-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1776-599-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1776-334-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2012-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2012-236-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2096-240-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2096-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2096-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2096-59-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2216-37-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2216-6-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2216-38-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/2216-8-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/2216-0-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2320-288-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2320-410-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2496-84-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2496-64-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2496-86-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2496-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2496-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2748-534-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2748-329-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2752-302-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2752-303-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2752-309-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2752-415-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2992-313-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/2992-418-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3832-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3832-50-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3832-41-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3832-239-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3928-366-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3928-435-0x000000000CDF0000-0x000000000D50D000-memory.dmp

Download

memory/3928-337-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3928-600-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3928-382-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3928-398-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3928-416-0x000000000CD20000-0x000000000CD28000-memory.dmp

Download

memory/3988-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3988-316-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4108-272-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4108-267-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/4108-328-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4108-273-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/4140-75-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4140-112-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4140-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4208-414-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4208-336-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4208-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4224-324-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4224-256-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4224-263-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4224-262-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4568-280-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/5116-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5116-297-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5116-413-0x0000000140000000-0x0000000140169000-memory.dmp

Download