58228d7090dcd4d8a2861c290e8e5026ac95ef7c34b102709d2fc9d88e798151

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260809-xdwzsatend
SHA256 58228d7090dcd4d8a2861c290e8e5026ac95ef7c34b102709d2fc9d88e798151
MD5 26f52f7133e2c20355544355180f694b
SHA1 6977938c0c480bb351c9ba3ca34f8dc994d70d1b
SHA512 b6cd6e01a5b31b181b12d3cbbd3cebb2ea6bad53808f0d1eec8044b1e3e950bd55cd283089b21df8bf19d01149b8cf74334092a96bceccbf0560770078595707
SSDEEP 49152:3+XFr1XxKxQMIGN1sm9nL4gKJZAg1BXVo/cRAdaCYUNCTpiLyONaB0zj0yjoB2:u/G3KPFo8tu98B2Yyjl
TLSH
T193167B17E2B941E4C0BBD13D8A979657FEB2784A877197CB4390861A5F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1116	alg.exe
732	DiagnosticsHub.StandardCollector.Service.exe
4800	elevation_service.exe
4220	elevation_service.exe
1476	maintenanceservice.exe
1748	OSE.EXE
2576	fxssvc.exe
4324	msdtc.exe
836	PerceptionSimulationService.exe
2560	perfhost.exe
364	locator.exe
4944	SensorDataService.exe
3760	snmptrap.exe
3688	spectrum.exe
3348	ssh-agent.exe
1684	TieringEngineService.exe
4968	AgentService.exe
2292	vds.exe
3036	vssvc.exe
4716	wbengine.exe
4776	WmiApSrv.exe
2196	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5563443a2d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-journal	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-08-09.1844.2628.1.aodl	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d599636c2f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010286a6a2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000dd87a6a2f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001521056b2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0d1156b2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070c1c46a2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007786c96a2f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
732	DiagnosticsHub.StandardCollector.Service.exe
732	DiagnosticsHub.StandardCollector.Service.exe
732	DiagnosticsHub.StandardCollector.Service.exe
732	DiagnosticsHub.StandardCollector.Service.exe
732	DiagnosticsHub.StandardCollector.Service.exe
732	DiagnosticsHub.StandardCollector.Service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2628	2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	732	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4800	elevation_service.exe
Token: SeAuditPrivilege	2576	fxssvc.exe
Token: SeRestorePrivilege	1684	TieringEngineService.exe
Token: SeManageVolumePrivilege	1684	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4968	AgentService.exe
Token: SeBackupPrivilege	3036	vssvc.exe
Token: SeRestorePrivilege	3036	vssvc.exe
Token: SeAuditPrivilege	3036	vssvc.exe
Token: SeBackupPrivilege	4716	wbengine.exe
Token: SeRestorePrivilege	4716	wbengine.exe
Token: SeSecurityPrivilege	4716	wbengine.exe
Token: 33	2196	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2196	SearchIndexer.exe
Token: SeDebugPrivilege	4800	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4512	2196	SearchIndexer.exe	128
PID 2196 wrote to memory of 4184	2196	SearchIndexer.exe	129

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_26f52f7133e2c20355544355180f694b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4220

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1476

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3384

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4324

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:836

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:364

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4944

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3760

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3968

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4512
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f772c784a24e68c77829af861f3e404e6474279961c450b077b9417631c3a308
MD5 eaa9337c537c41f63400cc9f9b9ab289
SHA1 7aec8dc6738e6b292d7b453a701e100c1be9eb47
SHA512 185ef8d600099b89dbaa83505257338e1d8129c11b161c35bbe04c9a6e663ccec84b5596749b59f47e86fc022ab9790fd8bc0b771877ba7e0eee3a969f973465
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnFaB0zj0yjoB2:x3q6HjB3B2Yyjl
TLSH
T13AD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 cd81e1829df87e5708e0a8aa367ba682c3ddf9132651c8a0fc91fe7fd93addd5
MD5 8f34b1a2e62c862a216e49ad36d8c8e4
SHA1 4481f571c739db55a83043633a2b91ba9e74d92e
SHA512 db5259556288ca86b5033e398e976ae23f3e95fbf571ef475f9887707fe60aed30d77025a0e674131f9f97a77c8253e8d3b16242754ee44eb39972ed75fc86f8
SSDEEP 24576:iXYfDtczAMatr0zAiX90z/F0jsFB3SQk0:ptcbaB0zj0yjoB2
TLSH
T12065022977D504F9DC67823CC9A18506EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d8a689d6451ee518bd9fd0fff0cb8ebddd4b21a37ad2052cca57e69febdda2b8
MD5 19038973ef07ad857a31ba22349532f4
SHA1 391557f4efa4410a4bc06a97b11ea15716fb7d8c
SHA512 89c78c8ab1eedda32a03af629a6f544dcb5b54fdb52539bba8ca57c01302454759fa015eda266e9b246dceaf9c7d9ca92f945dbb388e7d4943f4a68d5e83a15f
SSDEEP 24576:H0Le5ji0hmxirMtatr0zAiX90z/F0jsFB3SQk+:HPji0Ac2aB0zj0yjoB2
TLSH
T170859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8c422bc69bef68fcd6a47978f5b8ae2b32ba7d94ba83c226e4d3d3545894e904
MD5 9c92d0259393401d8c9a60824a216d27
SHA1 91e849e4b92aa6a4d3a02e7f5392713d8eabf8f5
SHA512 ee19ea0858454cb7aa8cacb69b83bf63018d3a43bf64ed2570fcdb11256958ec618a66897c178c9eb5cae3cc01bde2f69b8d60885fed5ce9c0f4e509be581ab9
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyuratr0zAiX90z/F0jsFB3SQkt:L/ezSC6vUzPvxHjy6aB0zj0yjoB2
TLSH
T168755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2b4a31e9b4721813cc7719a0866074b8368e2bc2d902325f802aef4b30733e6e
MD5 5a1c001fcf808132bffd9c69e55707f7
SHA1 51a7a0babbbb1de93cec02fc091d7618f85ef438
SHA512 17946acdd631da2a1d1eef6f709c4785bb39b2a4bef843f1536af379c0fb628287afe1c5a0b5631374ee03f11410f5f8f1799487d6643f1b8e38056a168285c6
SSDEEP 24576:pVbqPb88hv/l+6Iatr0zAiX90z/F0jsFB3SQkv:pVO88hXl+RaB0zj0yjoB2
TLSH
T18B55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7dea7262a96668963feb9666eead860e049cba2264497cbeac959116b077f4cf
MD5 9ec86c0c092bb3dd64c42cee3711b30c
SHA1 41ad7c5276ead0f314f30e81c471f433387acd1c
SHA512 60d409c5247543fd8ffb0f2861a1610b5ff1eedcc56a33d64c9c65c3dac47b93e618f29aff4f7020e899fe7c2cad5f18fb5cbf4c7494e8a7baa70e7abe46b376
SSDEEP 12288:zRJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:zRJatr0zAiX90z/F0jsFB3SQkE
TLSH
T1E345230B340E80F2CDC31B3566989C4B1AB99EB065E2AF85E1D13F4F9D3C1C695656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 88fcbc9826aa6f6dafa5f93bf2ee334d16e55dfbef4e90d36df6357999c322b3
MD5 7816d53360e7ea7996160108c8a2f479
SHA1 36784b99069eb8d94400734aa7411923434eabb1
SHA512 89ffaefdadb1c1fbb638e16fc3645557e099ad426776b3f80e8c1abf2d75d4c60a68453bdafc997a3ecdeaf9f471a866aa603482569f3055c5efc6c2d792df04
SSDEEP 12288:LeBNUbTVO86UQUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:LJIUQatr0zAiX90z/F0jsFB3SQkB
TLSH
T1EB65DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 07610f022ef1b7ccafff0f918e649d29d5dce9e821dc88b739a7b99ba7a1f198
MD5 6f7cde1de16591a1e1f8aa361805d1f7
SHA1 213cf9796315b247f43bfdbefb45fa7cd5f210da
SHA512 63654e0d5c5d482c51d13d4d6cff49b382a1184e315c454f05f5561a1370f3da5135102ed3d0bc8a92964178f7e47f1290ac4c6dded55806b550364c73569e5c
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:+QvGAdlCEL8c/yRNw5CmB2Yyjl
TLSH
T1F6267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 872ca21689ba6f0bb8f2010ff229786eab0485c22aebc3f7cb7bac06c4e662ef
MD5 6503a05a47fa911c18ac6011c6cf9d70
SHA1 ec8e4a1bc5648774a7a2203aa92d837690e4bdd2
SHA512 9bf8fdce6955d3903d211c78388586a224822b694c21bab4aacbcb800a39198f5ecd0976f6305e1a9a34210fbc17ea9f41d5ff8437d733e82b7bffb232bede5d
SSDEEP 12288:UAwSfxL/2Dc34DLLmt0LDQewsAjGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHS:pdewsAjGatr0zAiX90z/F0jsFB3SQka
TLSH
T17175E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 052e76c8a20f2c7a93625b4f5bc584ea13f8658656b06ce8f493c7e1881b29e7
MD5 fd38fdbad160ebf33e65db90c06e3f4a
SHA1 58dd7ba4f255ff39764473401dc5df773955a569
SHA512 8093d9f93331665e54e64abfc342af1d7937fd878a4c15637612abd1f47e8ce340eec20ab18fcf1ca0d8736bbdc98f4fd23dc410f31a850a8fa0d52d7e9f0c61
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJZ:DUEtQevvqc2W1cpV2EI327
TLSH
T1B5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 82f3bdd33fe00b8ad4a8f6d476aa3d1aaa94279dacd84e8830f8d32965373be5
MD5 774ce1ae24071032df7cdd166fd55f06
SHA1 856bd4a7feb436db3631602488e7ed4674363ef2
SHA512 bbe41b73732977faad1d519cec2c83c81bb56b1e42d70fd51d20a1f1bf352530ee556446e7b3719ab5792bba4fe1e66a22261559f829c69b5b1399e177b7ac00
SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/zmaB0zj0yjoB2:3oqtVjnmCB2Yyjl
TLSH
T1CCD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7fac8fd40e599aac4818bdcebab27115e871a195b876c85e7ee0993b1a01a82e
MD5 933e612c660d5696cf7183622fe43dd9
SHA1 024457b6db929b3c0788ecc84c561b69dc93278b
SHA512 85160649a609934b765bce25809f2d806b7607605c8882591d96af01e971a6bdfecf942297c08914863cf1bfbb2e2be58935058b16443d427c77db2714a82db1
SSDEEP 24576:7AhGLJIFoiwtA5l7S53vatr0zAiX90z/F0jsFB3SQkQ:7AMyFoiq5faB0zj0yjoB2
TLSH
T1D4359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0e88273479fa657f94dd7abe4f9a5cba66f3fd615694b35741acfe942415f818
MD5 d19a945d326053ee969c983bed6b43cf
SHA1 b641750c888fce6f63d3821939792828e83673bc
SHA512 cc7eef03eb6ea9b3d48908b632aff8fcb99a957fd06e47738def0419483f90940d57593577494569d02a15abd4c7cab0a609001e56bcc7dea1ef16203debe34e
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CLUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:vwuoOWaatr0zAiX90z/F0jsFB3SQki
TLSH
T18065F14A36A90CF9E9A342388647C536F7F2BC112A61DB1F1360CA5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 aac9f513ac2d16947419bd28b5fe4f6b8bfee6f152c1b82c06c4db205f7d2ff5
MD5 dc8960e011a8c82558b9ddf28aef9d85
SHA1 d38ef33218a04ff23a71b7b34d1f2d66d97b156d
SHA512 05a7c454e03c46a13d7a10c0a333e543d1feb2ef7889cf991012d81722361ca8d6fb312bbddf9316027f4546b6328688f081b737cfde519fc4dc3c6f16f1a4ee
SSDEEP 12288:kBZ1IyWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:CZuVatr0zAiX90z/F0jsFB3SQkq
TLSH
T1EF55124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 df86fbf3a46c2d5157cffd573d9d60f9b9f3ec62100f7c03af77397b1b25f982
MD5 e5d178bd514e0025d7f6899e5130df03
SHA1 982b8c184d0439fda1718844bdbdd2bf3f0bc4e6
SHA512 21f715591906c65a48c95a1bee06dcc259e83dbcec34445270abea6b16e47dfff478f97bc570726a4597549c4bbc21db32ff618a28940c521af5ffbdd83bb456
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:SQRQyi36YOcPQLvw2gAf+PN3LB2Yyjl
TLSH
T161667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 61602c6fc72cbbc5625478a87317d31c31267ae36619142be7689629b550ac99
MD5 b8df046ec83cb3ddcef2f1ac13723299
SHA1 c3bccd8fc8cfce18117bdecc87edc2449f3047c3
SHA512 9b5b4a414df8903e8e675805fe75b35bfe71d44eb739681d9bcace64cb89f35198363365f954378a6b9c55c173162923dbb8cae71c8fda4c65bd8936d54afdd4
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:zQRQyi36YOcPQLvw2gAf+PN3LB2Yyjl
TLSH
T19D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bd30c9ea2d2bdc44fd5e243c363da04e9d5f3836352e0972f8f2e48c7fbf5719
MD5 340023c12d942ce536bd35a4091d07d6
SHA1 50c5c3974900c3e3878eac638cb70960c442f543
SHA512 0bc5a21fd46c4059e2ec456ac872aa3b0ccccb7c24eda36badd496bd91d73cf29af2a9f8b7416800b4b500cf2a9182641540bc5e6f5d524b05f2e1637a98a644
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Fatr0zAiX90z/Fm:R68Qg55nhheWu7PNU3/2aB0zj0yjoB2
TLSH
T18BB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 155ac3d17aeda686e8aaf987f35f7441d9ee5f79b107f065e343869bbba560a8
MD5 f1b6d4d50bc5398556bb0d848678cb45
SHA1 9105661d2de753e96d3d80dda65d2650fc4a56b6
SHA512 ddfe3997fa348f5c4d529fa95c312836ffe336e13c1dfa28a45ae7fd81673f0517784aed57487f9e8ba8f7d2db7c656048fc07c44b92f1bef661051444a60c0c
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99o:Jy5112gYy5azzVvL69nLKnhZQB2Yyjl
TLSH
T13C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2f5f11b785313b36a0b837eca66de7db24df81146248b8b197f7233e74749a17
MD5 ceb75424a031fed593d7c355055d4bcc
SHA1 f5ffd49b9df5779bb1ae354089003ae628e5d095
SHA512 a6cfc004f1d1fe478ddf7e5f60f2a1b46a14678dec93e711b7a844566f7d6d6fb1f1f7f6b72df7fc33ec2f4f2c6d5e5d8438e43efcc23426ef8875d1b916dfec
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8aB0zj0yjoB2:Hu6JmVxd2dzB2Yyjl
TLSH
T179D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 617672543347b80ebf099b6f4299bdcd4a68a5e5cf0cba04759041afbd4e4066
MD5 e5b7d24b237cd1adff08e564c5426fd9
SHA1 2505ad1943da72eef6915bb483782844a11f3185
SHA512 d467f6ecfe0876a90246df83db3d0e1176b6e57896e30ecbed5289d88ffb6497d04b9de12db630d78141f5c0f40efe6b4ba3ef9ff879d2411d8f1de04ece9386
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xwaB0zj0yjoB2:NmifPbRCB2Yyjl
TLSH
T1BCB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a9e52208053b64ddf47d1b4c5da4a1694ae7b698d428cc0fe637eee161e507f8
MD5 549209f730bf3017e51ab8fb29120a15
SHA1 697d766c470db5f6133b943c3a64f2b4e224c09e
SHA512 5fd3de14d9a7e56ccdd836dedf59e75b5ebc5469b13c56ac1feee0c2ce386d674fb18d18161ab3bf6baa4b24db73a875bd52aab3987ec5f171a352fd9f4db926
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqVaB0zj0yjoB2:H5dKTi61EB2Yyjl
TLSH
T19FC5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1619cd30e71a86dc1a8559c5277b99e524b8d79868a6e4a5df155803d4e2de5e
MD5 46a8367e6d7a1dfb5fa0296a00e6050d
SHA1 95e2aa2f2c84c8a89088860e0aa0c543d4a5d0c2
SHA512 5f924c5a8dc71bf68cb51e7c2f6d18243c6eecb4eaa51272dc9b8acddc04d7599cbd049015e0895d23292d7dbff7b9701fdea032e88ff68cc6f9875c210ae4ed
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5wMaB0zj0yjoB2:LX2iypheB2Yyjl
TLSH
T1BD95BE13F2D900E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 014ab2bb0543e13037fda69ec1d5957b6960614e8862af59f63e839d34685c59
MD5 549e8e0e6be367d263ab1ae278e1e473
SHA1 63af111f98badecf3b79037051dc74e02b2a2be2
SHA512 a9ef4d1415fce28bc93ba3c2525180700ba426130b2a3f7863e74ef59af0b73d1d400c8ca2d19ac1dca0d7b5160ea91985bdcf51fb0c5a4e42df2c28c162f47e
SSDEEP 12288:PRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:PRatr0zAiX90z/F0jsFB3SQkE
TLSH
T13545230B381F80F3C8831B355684984B1AB95EB4B2E36B95B2D53F0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 215c36a5300a2c35cf854f404c3a574a2c9aef45674b599a3b7e291592486976
MD5 7a7de9f97bdff2c68b26d0a9926a4e25
SHA1 9970450d6d980b6a336c117cfe788024545359d5
SHA512 d1af8cac2e2e714037acaf1113824fee9c7873a828ae8581c04efbe6fbb7664f148e03e55dd5bd3a35270272c7f79ffb48917f2db2fa092db403a6c55f67db42
SSDEEP 12288:NyUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:Nyatr0zAiX90z/F0jsFB3SQkE
TLSH
T17B45230B381F40F3C8831B355244984B1A795EB476E36B96B2D53F0FDE382C61565ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1584cad251a2577d37b9572211a48568f492aa5742730d5590f7fe550f76d9e2
MD5 3208322c69e33a1c4a838e6778b1ffe4
SHA1 e616ceecc80b8c4d7cdc79f1a7238b58b626badc
SHA512 c273c23e951a6db98be1990ff56e5f6192a0d9e8e18410e5c92e838d61f91fafeb7a141742198b593e698d661c20fb13c21318903a9ae502b96b7ecfffc6e09d
SSDEEP 12288:e4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:e4atr0zAiX90z/F0jsFB3SQkP
TLSH
T13745230B381F80F3C8C31B355244984B1AB95EB476D36B86F2D63E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4e28442638b8d9878b7280efacaf0c762e04f8111f6fd650297bf6ff98663a47
MD5 e1b5d09f9304188dd0d803a4d11bf2ee
SHA1 8cb7f26028dd2bc427183c69ad8d01cb09f509d4
SHA512 d91c9044eb18006274c3541e4885a77714c864c7a433ab12a5888b8496d2959d5d410540659f4213c316640e33347920270ff7ee3531dc7db94601329a43e7c3
SSDEEP 12288:2VPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:+atr0zAiX90z/F0jsFB3SQkF
TLSH
T13745230B351F40F2C89397358694884696B5BDB0A3F3AB9FA2813E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3f4e3540d8413f5fc68e18ac7f5bb8622e4f60e6723ebfbfbcd5cd601f2309d9
MD5 88b3bc0fcef04fd06eefc07febd9b83a
SHA1 ae3da7dda57226baa6be7c33dc45121336a2dbd2
SHA512 06116e5002e101accb880d74a88ba4c888f7d3e7457cc48c26eb59f724302da3f8e3dcabd3de3fc953ce12ca46e7d19cb39578554e84080d5238b11fd24d45e0
SSDEEP 12288:/nUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:/natr0zAiX90z/F0jsFB3SQko
TLSH
T1E345230B381F80F3C8831B355244988B1AB95EB476D36B96F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7dfd5fe4b56240df1ebc70d8f739159c470479a82b8ca1fee4c9a938fc140061
MD5 ff4a2036518e3acc17d4f92103710b22
SHA1 9777041e1df4d14c52c81b98176b732d02bb67b7
SHA512 4eced837ec90ca1aafbb613300edcf5c0e2cdf33724936795443a30da2ae7853392e1b51d92d279074a1ccdce7278bfe94cd5c5d22278e7b961578d72dacd1f6
SSDEEP 12288:RuUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:Ruatr0zAiX90z/F0jsFB3SQkH
TLSH
T19F45230B381F80F3C88317355684988B1A795EB476E36B96B2D13F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 936b30757adb07214bbf18896986ee725e912162c4eb4ea60b8f86d0c59935c9
MD5 fdc06271a6020f0ff5757c5fe57fa7dc
SHA1 4a4ea37493fbadc56a0ac222de0b2ae672c12573
SHA512 a54d758fce2f2206c11130b152d19fa00205748f4d997aa29f569b646e4d6b462f760ef7af68a57144c54f2b67b94017eff82d97ab5ab64b86df2237c86c6559
SSDEEP 12288:+KUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:+Katr0zAiX90z/F0jsFB3SQkv
TLSH
T1B845230B381F40F3C88317355644984B1AB95EB4B6E3AB86F2957F0FEE3C2C615256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 63eb259c4072aef86737b0fc3d5fdb8744e4fd6343c9e791d2c6f862931066d7
MD5 2748ca9b63f5c8045c2974edd1b8df9e
SHA1 32bfb3ecd3db392994472f3b6a4bfbac8ceaf9bd
SHA512 cb12ee29734ef5c1bcbcf6544538150e2b7565d98c62b2b739079497e772f17367d48e06cf071e0161c4f6d64909172decd0f0392cd079e0fc1403aec006b613
SSDEEP 24576:oZMSzFVSOSatr0zAiX90z/F0jsFB3SQkf:oZMSzf+aB0zj0yjoB2
TLSH
T1F665019A735018F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8b1c9262d0d31047449ba9ab1dd0995c05941009ce3fdc372d8d420c530e46a8
MD5 57f93b1157de574995ed9fbd4921a0ba
SHA1 9cbc39700f27a6d5f66fada366c45b4a0de500ce
SHA512 1439e166af5a6712b49dbf20cab7539a2c8d0ad5e46b3a7632c26332aec14825633e24c0631a957d25453e6545eb35943659cf551d3130ef873ea2104d2407b9
SSDEEP 12288:4lUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:4latr0zAiX90z/F0jsFB3SQkx
TLSH
T14345230B341F80F2C8831B355244984B5AB95EB476D36B86F2D63F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 547ed0316a6453202b54ebedd262078d48fe6e77896ac93ce784b93c93716f02
MD5 9f56c8c7a4ae721d2f3ceafff868151d
SHA1 b5e126ea8d8a20a43fa261efcc5ee40b276bafef
SHA512 3fc89a6a82fddaad0d64cc99d299275db72a850b49dc7cc8c0b8d6551d252cf2baa510df350662b76b872b534f7532a11129f3c62a3ff3176ac80483a09f3b4a
SSDEEP 12288:fZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:fZatr0zAiX90z/F0jsFB3SQkK
TLSH
T1C145230B341F80F2C88317355684984B1A795FB4B6E36B86F2953F0FAE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7bd2f59c287a6ee74fe39472270ad09b2afb946b00f28a7efee23ca51ffe4199
MD5 16ca419f5ca7a1ce9cc50796db2cd9ee
SHA1 e8fa01d475d4d5aff55ee918a4945a6169bdb4ce
SHA512 a67cf57d8e2ecd29218ef2e37cfa9a80ae8d6ebfcb8f20db8b866529274308bda0c9c988c2d3f9b007da1076ea20bec8662f083801be943c841ecb8dbaf9a1be
SSDEEP 12288:QyPz5L8WUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:hzyWatr0zAiX90z/F0jsFB3SQkT
TLSH
T1D3551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 05dbc2a6b4f682ead8b90cc4891b07345cbc6e594b79dd08f022a8fe056eed85
MD5 bc215428b2ea480b7d0b6c04dcf12edf
SHA1 83194e1e6dcbd86f9c6f1c3b921115ab307ebfdc
SHA512 6eecef15d6430c188e647d3a6f4cf6e92ef4098c26353b9b964a77d632b97590d3fe906daca57e5a102b8523c8ef37bef8c0d1db6d29ee3e0b431ddcd2beec8e
SSDEEP 12288:PlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:Platr0zAiX90z/F0jsFB3SQkl
TLSH
T1E145230B341F80F2C8831B355644988B5AB95EB472D36B86F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4d896c44d62ebd8e3581b56398e99e01b396848b28cf924c0593649e83964e03
MD5 cc8627d9c5098f65d44b23b977f8dbb4
SHA1 995d2ccbb562fe75f1da708c4e2781e6ae2991df
SHA512 9aa1c4088951b18f1afdb7bc002d08dbe7ca71e33f66fc89e3f80dceab8df225c22d17bb887e8d8721c252b853abbba688284ca5cf0e0357bc8d8a77098778d9
SSDEEP 12288:/lUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:/latr0zAiX90z/F0jsFB3SQky
TLSH
T14645230B341F80F2C8831B355648984B5AB95EB472D36B86F2D63F0F9E3C2C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 624acd67f669a11e84b3e4c53fc81b907c9df0319cbaea0fa5dc859a7521f615
MD5 6953b6b10c8cf8475a500118baad30c9
SHA1 0435fcf33e8a6c77dc571bd056483540472540dc
SHA512 330bcdc7722cf2b873ed62e97501f8d07a4c2889de90933717e7dc214ffb76480a8ad83d17ba9f8fb0b11839daba889ad240bb1078bcb2637f9429231efcb2e7
SSDEEP 12288:EyPz5L8WUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:dzyWatr0zAiX90z/F0jsFB3SQkY
TLSH
T19E551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c17287ffdc9ea9849eac9425d8f17307fb3319bc5271bb7a158469500b36735f
MD5 6e7eeedcb563112999bd72ca2e376b46
SHA1 6f7c7791ee2640510d279765c68921b7cb9a88f3
SHA512 47fcbb4200de6bc0985a0ead65e8d0fb318c52841838189df51c16b55a9a3d27275658f62a837832d5f585d7562c3ed5548674ea0963f85d1ccc2825f7af449e
SSDEEP 24576:QTHaLl3z0zDoatr0zAiX90z/F0jsFB3SQkJ:QT6LljraB0zj0yjoB2
TLSH
T10A650199735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8ba9dfc6413e3c196b6054441781cf473f4fc984ffc62fddb81e2cf8247f5c24
MD5 82ebbed46cb1caf8879a547d92c97d1d
SHA1 07ef8eb4fc65ac35e027c06f74a070e835a0b73f
SHA512 d53e979ba53f2ee24a99ff7b23e37a4e2cbaf576ef6fb3b1d7d8ac4d4e77a6637e2b8c5390ea43fcd093a21ba7890972237e58e0bcafa64d1361c4c1c7a36252
SSDEEP 24576:j37d9CHKy7GZ0atr0zAiX90z/F0jsFB3SQkZ:D7d9CHKya+aB0zj0yjoB2
TLSH
T19575CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e9421c45930f6c0fb3efae1f4fbb1e66c89381296aef4454d08ca3b3be628d49
MD5 7acedb74e23ce9f70c0945aac2d57841
SHA1 7fac5958e5e45414e1f28a6592049023bf64add0
SHA512 02b5135680cc4880824413e9d3ccf9fb671884bd20809a0a433e88e0a7784cc509c7fa8679232d6442c9fbdb32301c4663feec03caea95702057dbee5305ff29
SSDEEP 12288:9YUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:9Yatr0zAiX90z/F0jsFB3SQkf
TLSH
T1B945230B381F80F3C8831B355248984B1AB95EB476D36B96F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6d1937cff1c73992545a6e7d534594bc177fe2bdf6ec48cfa4c28bfe69f047e0
MD5 cf5de582bad1ae90c1445ecc2b66e5d1
SHA1 5b21098dbf5ccaaa8d7707985c7af42fdbb10247
SHA512 bf039cad6f555e8be405c6f7f282bc93282caba8aef42335f4786d70cf0d670876a19f35a7f55ae1c95934e5928413cdc928f41e3d880bbfad623569d5c03516
SSDEEP 12288:C2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8E:C2atr0zAiX90z/F0jsFB3SQkH
TLSH
T15945230B381F80F3C88317755288884B1AB95EB4B1E36B95F2D13E0F9E3C2C615656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9e6fc476054e2c1d7f2e975b5c1b9707c07b92a6457f66b45d8ff6f248f47602
MD5 f8ee284bc27792725a47c2d008a58f16
SHA1 dcbf0dc9dafcf61a5d28e44fab7702430505d282
SHA512 0dfa5bb495b366beb877b9115c3f0180adea89aed2a4342e4f15e2a0a9febe2a3619569d968ed566233de45061726f60a87f8d06721135efad83867a116045a4
SSDEEP 12288:bjUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:bjatr0zAiX90z/F0jsFB3SQkT
TLSH
T1DC45230B381F80F2C8831B355248984B1AB95EB476D36B86F2D63F0FDE3C6C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b3943d0471c7388609278d4d8d9cc87f6c9f5ba2e36541e47abb2e15921ed039
MD5 61568f9a36e21a30609a55aa963ad34b
SHA1 7ffd811a25cce1012c10772fcf6763ba7c87f3b2
SHA512 1fdbae34d10bb155d32a54892c02418bf1d46264ba7e933d7f6c108a6f2c6f6c11276a09a8a4b50199b39ee23d6c90a84805a3d7fc100c691553a6464abfe549
SSDEEP 12288:XNsfVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:UVatr0zAiX90z/F0jsFB3SQkw
TLSH
T1DC55F00AE25801E5C4AE6239C7544A41B7777C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a64ac352938b1866b696a54a41a319fd9fde918f2ac818cb09741eed132e76dc
MD5 7162536f123b8ce58a9c78589dd264a2
SHA1 66fc577fa64c4c2c3e52d8b35e6b6fffa8d42eac
SHA512 d398ec29f513af164c42aae3570b6bf41db8dcdb2c957b085a25d67a348876a074b09efe9f905de14139147da148071bccc89882808453f59e19706cd4d02c21
SSDEEP 12288:uWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik84:uWatr0zAiX90z/F0jsFB3SQkP
TLSH
T1E145230B351E81F3C8E36B301658C81A267E7A746BD29A8BF1813F4F9D385C259356CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5d3b826f7ae814841d67a84568d9269b48ca7f6b7372f7e9a92cd29b043bf6f1
MD5 0103b140b1d2f9c673a1edf2b838cabe
SHA1 1084a3175f297723c6bde60a70f3c785804c46a1
SHA512 1bee602976412bac03b72b45ccd1cb2fb031b0531014ae3b11880d4f49b8483ad16d944d32b1fbef6340ec14d02668145f49c8a4bb9b1118d885d675089ead24
SSDEEP 49152:Ia0h2GEkuAe73q3pp46zwwQcaB0zj0yjoB2:Ia0hNYG4JwEB2Yyjl
TLSH
T13485AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 3486f28058b3f0e2c1dc94c08fc8b00d3c9323d1f898f69c1cfa4f172898c154
MD5 101797929b038afede69c7d7aeb9ae16
SHA1 fe360c14da8998d409af5c23e3182849864b05fe
SHA512 711223b9c200ca197d99dcbdf1e6baf44bc14460ed41120c9c8ee1b2fccf4dd1be8ca04bdf1123e3dbf04c55bf1858d45d2bcdec5dcd33a02aaedeb923a40d98
SSDEEP 12288:6hbHjfXAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:6hbHjPAatr0zAiX90z/F0jsFB3SQkf
TLSH
T1AC55126F266D10E5E4B2A23D8584850BC331BC341762A7EF62D1A27F4F3AAD51C35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 93956e5242362b6a3c2d67a1d96517585c5cd8df5ccfebc1cf3b1a3309944113
MD5 94276a109b8f3e6e5d5e68f30b72cb85
SHA1 87a4212ee1faa06723d8cbf2d16083cf0997b636
SHA512 5417b0d04f7c4f4b832d50d143222072e3148e5222d0ae93ae9b562e4abac93acef506734038b4888bbec60e3069473131e7442b7f09e41fe0a8cc87fa836850
SSDEEP 24576:S3YgnJcRTk4yti+R5dBR/Ratr0zAiX90z/F0jsFB3SQk8:SIgnaTk46pBR/RaB0zj0yjoB2
TLSH
T19B45BF2EF2B910F9C8A6D236450147B5BB71782D1F209ACB0170C639AF1AED85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e65cedee138e2781038beb6ce4a8dab70fd6ab04f32f917660fafdef7dcc3eab
MD5 584baeb52a889c2b0b0f7c2c6238b5bb
SHA1 1040496268f34fb5b4831cd16e06ccb2cbdb1851
SHA512 6a83ae19145404ad6b5f58243bd742863f02f9ce593cc3a36429efdb9f848ab95a676d47030cba8c9d3007e85b1279cd17478e7cfb85f0f39297ea64d6912c4d
SSDEEP 12288:AqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:Aqatr0zAiX90z/F0jsFB3SQk+
TLSH
T1B045230B340F80F2C8936B755688884B1A796B7063E36BD7B1917F0F9E386C726356C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 41e676092fedd974ffc3cdd2718dc5b013f4af0b4a93d4a6a932829b94b7d963
MD5 85454b16d31145df69c0bd2be5930fe7
SHA1 c9cf2b7153db50ba4d8544a5b5e9243b49f0704b
SHA512 153159113d0b97f683bbcd902fb0cca1cc0bbe6e779bf9bb2886a5fd6d40584fe965745a8b59c361c34edc9f93ae37eedb74cb5fc7f304ebf09290b409376022
SSDEEP 12288:XOb9A4LWOsvAYFTvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8C:4pL3UTvatr0zAiX90z/F0jsFB3SQkF
TLSH
T1DA75F106F69500F5D867923CC9A68917D272B86D03A0E7DF03A85F5A1F237E24E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ffd58c170af903cdbd2095263f6a242b7f38277aaa414a9b2ba898e337725f3e
MD5 234c9d1b263d4e168ab037003fbdb609
SHA1 2dbcc29ac7a038feb81145f52b29239bd2952e00
SHA512 ed5a206f1d4e6b7cd6e4eed77405b3b873e808cd5199ea19795517850323015b8d145b824dd4eb81d4e451a32afc24b553b6df883e1874a0c4e1be9b7b68f6c2
SSDEEP 12288:MpFtpOzUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:GOzatr0zAiX90z/F0jsFB3SQk7
TLSH
T16855121A369D10F1D473A23C8A81820ED371B871176257DF42D0A66F5F77BE86C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7bc13eda89a4f16e54fbe030f98cbcfe10ad26a6c4d0d77dd9b246f7b5ff5fc8
MD5 ee29bc1c1ff4c44eb22d71b7d42046db
SHA1 d65145e0e05c666bf4e039f066a5d59f30e15cc3
SHA512 a97ba964120482cbf03439f921fdd7642b3def8dde6a699ff25ce8fc1432f4720eac4214a18a643733ec3c5b6a5c19686cb8a401ac08391c22df311f3c8672d9
SSDEEP 24576:q7NM9YqZqmWMUkPjZM48Mv6bEhsGatr0zAiX90z/F0jsFB3SQkn:q7cBWMpPjN8DbEh5aB0zj0yjoB2
TLSH
T12465AE2E6BAC81E5D477D13DC9A28606F6F2B4611B318ACF1152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0d40e060a3c6f5c3bd6a407e1bfb81c18de3290f61c35ac7897c5caefe25defe
MD5 d3e1205fc6984dac3cf0e69ff6b1b112
SHA1 6a9a6b01cf204f04893a1345da9ed7eb98f61480
SHA512 603d2b6275565e05bed8a4bba98743a3136f9670564d42817bd746780996f6244f475e07baf6076b4382581237d9d9256c17f52924a50b38537ad567fc3e4083
SSDEEP 24576:yW6BApg2YuyuNDYTabvcdvNYf8km1Yatr0zAiX90z/F0jsFB3SQki:yF2YuHNETovAvNYf8kmmaB0zj0yjoB2
TLSH
T121857E2A27ED80E4E0BBD27D45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 de3f6126b93ef62d0b96052f19b5fc112dbfd13d30600af08d7a4766ecd29020
MD5 c5e94bc0adebc7fa9ca80a02f37b4ae1
SHA1 696ac1dd795514779649d4a757ed67a4ec1ffb14
SHA512 2bd653b1d31c995c1a3fa894817e1c703b8a36bbc09f4ec3355a4cad746ddf01d3b918aa428ef22ad99a8306352ad6bf638b5c1feb8949099c5d345c06fd6ee4
SSDEEP 24576:uAFs06+Omlf3NXEbTo3atr0zAiX90z/F0jsFB3SQk+:nFs060lVXu8aB0zj0yjoB2
TLSH
T13865BF2F66EC00D5D07ED17D8A96C91AF7B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 5307d637db6a64464a915b6988fb90f87abe30d41da21694b0ef2e6658d11175
MD5 ab0559e537c35224bac77028320d66e5
SHA1 85b287c9aa3e799d0b97d37bf1c0852a70abc57b
SHA512 0d3eff3fd40d5b92521b12b7c311911c21e5b12a6bb1c3a7b1db1f16b362e9aa6a8a3c96b3856b7c68bd8ff5a72306a438b53cf058767a02feedd1d34cb9d400
SSDEEP 24576:3JnJ5D3WX8atr0zAiX90z/F0jsFB3SQkf:3JnJ5DGX8aB0zj0yjoB2
TLSH
T15D75D02DD2A810F4D4B7C27482991B46FF72387D2B226AC724B4E5357F12EE09A79F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 68e0b7ef6a1e965426988b0a8c3fd8982580cfafeedbcceed96f1581a1182cc6
MD5 d6f14ac693479093727192848ade5e1e
SHA1 386b7ddb432da5ebad473c339a9db133f52a9f9d
SHA512 9db659bf287a6b2a846c1e337c3310be02e6628abe52649d57867ae7560a6198e41ee4ae947f1e89aae6738f18fbbf9db0db7c97f64306e4929ae5d216728853
SSDEEP 49152:Lg06DIKdwc+eQnSt65aVSaB0zj0yjoB2:E3B2Yyjl
TLSH
T19D956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d8430c694f5e05cea8391cbaeca50bd58014af0c6f8207e1c7c33dd85726c879
MD5 089d15b056e596937dbf977f7d446cb6
SHA1 7c5e357672b54e78042566f95feb2205d20212f9
SHA512 0b396b7734f3397312c94a605c37e4c602af179c2a944886cbfc74c0c675fd36b3a38e1c43511c7163020ae03b4fb8712cd8320f59c53b0b0e743f45ea35458b
SSDEEP 12288:/EP3Rn9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:En9atr0zAiX90z/F0jsFB3SQk2
TLSH
T19B55125E365D60F6C463A13D85908506D3B2F07027922BEF52D1E63F8F36ADA2D39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 c75143d0e5dd0b8312d593b0b9f39534e18243f6485778db0a6a2da22f84b8b4
MD5 9f07ec3506c35a1119d7e2f02eebae72
SHA1 98902071b80b5d0650c656ee25e18bc603e1e5eb
SHA512 2940249e416fcb29a6586de9eda6396fd21f69b7f4e14a0060ccf596e6e6adcd8e4b51b218ff69ac0855206260226c248d92d42a8a01d0f8c6ec6fa3d97bdfb7
SSDEEP 12288:yjkypUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:yIypatr0zAiX90z/F0jsFB3SQkN
TLSH
T1C055120A335850E1D9B306389AA181855B75BC306B6297DFA0C0FF2FAF397C56D34B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 5da5c181c476c861b5d5b465de91173bdfed0dfac6ad0e26fc474db176285049
MD5 2ccd17dad92faf59f88ea575ececc391
SHA1 3a1767410e16731583d62960c47a0c396af51160
SHA512 94abd7517cf8e5fcdd4cf2151c24a7f1cb68b1789210a059da9a120f4a042e6685ee94f216fa1eee59c0c784d94c8c25c442f17090c168f7366bedd1bc4b2f63
SSDEEP 12288:6yDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:DDatr0zAiX90z/F0jsFB3SQkF
TLSH
T1C545230F341B90F2CC83177952588D4A16757A7027E26AEBB1D1BE2BCF382C62175AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 96e298f1fa1b27c1087a17e64d957c8a211d41fbf8227288065859e1f18bc15b
MD5 3a95d2c70b3f8abbc294315bc3fcf9f9
SHA1 cf485dd2d041a0eda6c5d3aa523f5437c55e8706
SHA512 1ee4e263546036ea861739f74d3301daec2bd256a02f66fb81526733a8e9395e6142da728a712ff72679cc3ec760002d074b5c7f3397cef977fa2520851c7c6e
SSDEEP 24576:2Q9MxZKdcz9dw3Oatr0zAiX90z/F0jsFB3SQka:2VKZOaB0zj0yjoB2
TLSH
T1F0558D2DABE905DAE173D23995A250C3A673B4301B31D6CF2448D13D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 9392888e2dea422da51bda1853131ebcc473d049bb21b260a2205d939e9ab948
MD5 f9be118fe903bec47ef5dd12c816e8e5
SHA1 abe621afc699df77ab5823da9ddd66891b60fd6b
SHA512 47d42b0ac1153bc030560bbc94569b385dd068d6601009f079e3c39d59bfe31c38c75761729c44bdc148a24fc0acf1ee752e8d9668f6c01261bebd3cef76d609
SSDEEP 12288:UyoKo2JRple9p9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:UyocDAp9atr0zAiX90z/F0jsFB3SQk0
TLSH
T1D465E01F7B6E40E2D063923C89848645E773B0705BA257CB6191C73E8F27AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d7683c5ced933070a79123bc7e564229f89f5677e9f0ae75fe4dd7016a90ae57
MD5 02e2eeee986129cfcefd34b9e35f26d7
SHA1 7ce1d07f3d1ef57442435a030dc6da3dc1c0aaa5
SHA512 e8535ae96ee0e4b4d0fd00ccbf57ff7730cda0b781635c9db70786b07b4d5a02e6379dc004a6db72fafe1b623deb4db9a7808de9318329859cf3e12f3ee7a891
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK9aB0zj0yjoB2:V0zuNIiB2Yyjl
TLSH
T123A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f4a32e07db1e2405f5e145702289e8650e5412a445dc9684bf3d6354b269d8cb
MD5 ffbf176c046af32d1d05a79bab2ed36b
SHA1 4dfc8ab2e5f6c395d8421bfdf4588328a17e80b0
SHA512 0d901f04d2da10008b6f7b77fccb9315bae12257cada19c50f0346d12af86b9ddf1ddb1f08c78295d2985b0036cc13b63be9ac300c45f84926ca7dd7929492b1
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYtjMqb9atr0zAiX90z/F0jsFB3SQkb:OTDxR+N5YzTfjMmaB0zj0yjoB2
TLSH
T1F455B02E67F905E9D1BE85799A23C502FB727821033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-280-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/364-332-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/732-16-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/732-31-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/732-25-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/732-24-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/732-237-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/836-266-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/836-256-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/836-260-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/836-324-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1116-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1116-235-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1476-75-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1476-71-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1476-62-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1476-68-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1476-73-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1684-416-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1684-313-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1748-87-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1748-240-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1748-83-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1748-77-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2196-338-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2196-417-0x000000000CB80000-0x000000000CB88000-memory.dmp

Download

memory/2196-487-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2196-363-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2196-380-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2196-347-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2292-419-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2292-321-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2560-271-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2560-276-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2560-270-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2560-328-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2576-247-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2576-254-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2628-86-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/2628-33-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2628-1-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2628-8-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/2628-6-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3036-325-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3036-420-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3348-414-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3348-303-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3348-309-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3348-302-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3688-297-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3688-413-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3688-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3688-291-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3760-385-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3760-287-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4184-426-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-456-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-459-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-443-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-444-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-445-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-446-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-447-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-448-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-449-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-439-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-453-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-454-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-457-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-458-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-455-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-421-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-422-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-423-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-425-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-450-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-424-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-427-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-430-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-433-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-434-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-435-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-436-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-432-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-431-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-429-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-428-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-437-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-438-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-442-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-441-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-440-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-451-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4184-452-0x00000254D0CB0000-0x00000254D0CC0000-memory.dmp

Download

memory/4220-239-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4220-60-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4220-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4220-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4324-320-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4324-251-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4716-329-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4716-469-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4776-333-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4776-486-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4800-48-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4800-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4800-40-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4800-238-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4944-283-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4944-415-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4944-337-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4968-316-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4968-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Download