1c60456c981d41af359a228b0d08a0df15dbd9ccdd2f583e8d1b24ef26eb007a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 3.2MB
Sample260822-e1646avxgt
SHA256 1c60456c981d41af359a228b0d08a0df15dbd9ccdd2f583e8d1b24ef26eb007a
MD5 4739362057911c578256ba85656edbcd
SHA1 1efbd1984490268b7a054c03a878b70d6d21f4f0
SHA512 06e870a6a625015425ef49667f8ee9dbbc412b181848bc74fea91afbce8371c40b8ce729bf4b3255d728def045abf57ddb57bc76b8af18ee618632caa4ad8a65
SSDEEP 49152:CaBGl8SPbjzZro8mKR47Cci4OPOdKNnafPTixvQ/lFTjN4:YKL6Uun0kkLm
TLSH
T1F3F56B23B1E600D9C04DD0769F4A9332ABE17C658FB0A3DF465072161FB6AD46B3E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1192	alg.exe
5072	DiagnosticsHub.StandardCollector.Service.exe
4116	fxssvc.exe
2392	elevation_service.exe
1848	elevation_service.exe
3484	maintenanceservice.exe
372	msdtc.exe
2296	OSE.EXE
2504	PerceptionSimulationService.exe
4424	perfhost.exe
2412	locator.exe
2832	SensorDataService.exe
1224	snmptrap.exe
2272	spectrum.exe
4388	ssh-agent.exe
1536	TieringEngineService.exe
3184	AgentService.exe
2440	vds.exe
3104	vssvc.exe
1480	wbengine.exe
988	WmiApSrv.exe
3220	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\37cdfb7579c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043b08282ee31dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001311a482ee31dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005cfe9082ee31dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b3d2f82ee31dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023661782ee31dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b58c3d82ee31dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7f80c83ee31dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1122b84ee31dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5072	DiagnosticsHub.StandardCollector.Service.exe
5072	DiagnosticsHub.StandardCollector.Service.exe
5072	DiagnosticsHub.StandardCollector.Service.exe
5072	DiagnosticsHub.StandardCollector.Service.exe
5072	DiagnosticsHub.StandardCollector.Service.exe
5072	DiagnosticsHub.StandardCollector.Service.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3384	2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	4116	fxssvc.exe
Token: SeDebugPrivilege	5072	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2392	elevation_service.exe
Token: SeRestorePrivilege	1536	TieringEngineService.exe
Token: SeManageVolumePrivilege	1536	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3184	AgentService.exe
Token: SeBackupPrivilege	3104	vssvc.exe
Token: SeRestorePrivilege	3104	vssvc.exe
Token: SeAuditPrivilege	3104	vssvc.exe
Token: SeBackupPrivilege	1480	wbengine.exe
Token: SeRestorePrivilege	1480	wbengine.exe
Token: SeSecurityPrivilege	1480	wbengine.exe
Token: 33	3220	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeDebugPrivilege	2392	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 3312	3220	SearchIndexer.exe	125
PID 3220 wrote to memory of 436	3220	SearchIndexer.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_4739362057911c578256ba85656edbcd_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1192

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2360

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1848

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3484

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4424

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2832

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1224

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2272

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1784

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3184

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:988

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 754afd74ca65038885d09b3fd090c076d98669e928606a559b62cd4df25944a3
MD5 3be126b91aa2bff420a81654bdec506b
SHA1 fe9f015e6aec39c9c4715a3d6360cf35302b3356
SHA512 3115634341ec8ea1fbccaf593a01acf690f78b49a9ec5f930c42b4f689f97cd578778d4be581c3528577681507e76a9bc90b9ef2aca32a81d29854e309aac7a2
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6Q/lFTjN4:13q6HjBaLm
TLSH
T1B0D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 74c2e60f965c4d7b7eff89f21a9936d61032656f4b0b3186a4c01a6b75ba5761
MD5 b5df0df1261cce0faa5697af4888eedf
SHA1 ffdb978b47be28a2480977a671b093124b1190ae
SHA512 96c5ee717de1376664911d8293f26e8aa078597884b7d7cedfee53793eb2486a55fb9d4b11fec6f8fa362704d97b5b5003d6478b72b1535e11fef3cf1b9412a0
SSDEEP 12288:E1XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:CXYfDtczABnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1B065F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 70088979630cdf0040f4d5d1b8a00734abd05838dde01b5ad3fdc51f752f9690
MD5 4933729696e4f11e6ff5227e68553bcd
SHA1 16bb34e9b4851151153df5637175a9969963c489
SHA512 107d8ef0760db658833935705a5ccbed3840b52631725f27bdfd2fa86d95616e465ca18e23ca4e752a6b9ee5d6bc601006c0f58b7710585f2b7660a67cf4047a
SSDEEP 24576:I0Le5ji0hmxLrMznQ/tbw/2Mkjy6Fr7g0oG:IPji0Al6Q/lFTjN4
TLSH
T18B859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3da25c10e3683c2524db7310df1507489fd64eb1b0043fc096300aa7ee7cc513
MD5 56f2fbb3deb99dd6791e74143a1a52c0
SHA1 422891cd19699f5fa14596d9efe7f3603d746b4e
SHA512 55a6f1c2ce70e520f2dc57eee4adc7cae28ba199396828dc528fd7ce99bcd41427e7dbc10259d3f5ab8e94242b04ee988b98ff410531554b94f9e78e097f83f4
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyuRnQ/tbw/2Mkjy6Fr7g0oj:O/ezSC6vUzPvxHjy+Q/lFTjN4
TLSH
T138755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b48ff59344390a7d7c897a27cd256f70f02bf103e443d04800b90df8dacdefcb
MD5 62e3930a3d80134d5ce65bd0e9774378
SHA1 dd80df7f8facc48111be406da09dc631c902aaed
SHA512 444678b60a5ada6385290bb26b1195cd76310cf038099f5bafca7c7f3723e174d47d65e28c681a15030470cc2b5d871144639ce370edfa4111f3f776a5a97447
SSDEEP 24576:1VbqPb88hv/l+6cnQ/tbw/2Mkjy6Fr7g0ox:1VO88hXl+XQ/lFTjN4
TLSH
T19B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 191d22103ee642fa3cd846393d98af477697decf95a293c2c5f8cee3b220c7ee
MD5 23440c823a8e9265aaeb18f7a37fb2c6
SHA1 d55e229a18ea3cb84c61e7ccf4d52ecfe11a0d43
SHA512 4816c316ee3d77947a444a309a2865712a41871c40f2571a56b36480785994661175cb21e534cc2ac821e47e5fc8968b9b7725ad417ece8f6096eac67ffdcdc0
SSDEEP 12288:rzvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:rzPnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1C45523796A24F897FF2B06B15C8284826B3B0EC1BFD4E74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2e57bf7129bba247a1bec5eb598e4e5b12e4d0f6e424fb978ccb21c10a39e2c7
MD5 552b15f818b0a9c101e1b68eb67669c4
SHA1 712a284d21308b7defa447119b211b8da090f32f
SHA512 893e2e8479f56792166173ef4fba79da05e0f5b1e908f0750643d3502f72156b947f311696556c8a83b82fbf377ffac172d643b306cff5a609f83c8c9f020f04
SSDEEP 12288:6eBNUbTVO86UkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:6JIUEnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T13175CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 978dad6100b2c553a22aa7a4fcb610b830a4cd17bdfcbd414d4c98fd70ccbc0d
MD5 37306928fddd529abb821f365e7ed18a
SHA1 a18b2ddbd9c8eb46f51b538c451243bf242f657b
SHA512 6ea18606e44d35f59708b199bc5e462667d97981931ecfed282a6a33a693245e8a9aca9f549f15df73594c0fad5d42d0fd3c5d09cf944ac43cc31fa305dabbef
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:ZQvGAdlCEL8c/yRNw5CmLm
TLSH
T197267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 bf2290a46110ba196952a8376afa6bc70bcd6a5099bc3a34ae3ab380fbf2e71f
MD5 90a9e120b14b22930b96d145a4bcd126
SHA1 7851180af0318f3df8f52cedcd8e6847db9b1278
SHA512 dcf45b23515c16d53280d404e63d59aaa8e2863e07cf3ac807dfa07fc8455c4e02479d531f58d41341a10616e8b1a760a6cd7db2aabd56eceb8503b3bdef9a51
SSDEEP 12288:VAwSfxL/2Dc39DLLmt0LDQewsAjqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgM:2QewsAjqnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1BF75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1f26f8bbefc22c514c04943e79dc7ccf5569aecf71f74a86dff83b8b85651edc
MD5 800b055bd8305e4d0f5898b60f8f4701
SHA1 84ba5d69cba50540e402625d3a5fa859dd98445e
SHA512 769b0b452d930c4623d60bed4074fd9059350bc876bc32b5aeb1aaa44d53a55ffbffb7b5e12b3f3b64dce383a4c41e774e4143e1939969926f584d89fca7320a
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHNL:WUEtQevvqc2W1cpV2EI32
TLSH
T1BD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ddab18dd8330681c75904765d9d646e024de999d3ee175819d2c46863f9ad053
MD5 c12954a8ff675012774b494af75f24d0
SHA1 3e8edbc841ab206205b578203827ee8e47da73e1
SHA512 a33bb97d8fbabb0e784cb2d28842e815256f894861ea2898cd0079ba2769895ca5a6c02c1b45467cabca694a900bfb0b858cf7a898f0d35c48484b7fed3a02f0
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zKQ/lFTjN4:roqtVjnmqLm
TLSH
T115D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0a53d65dd8b0940aac6022d595704d24458ed25a351bf763a5c71bd9e144916b
MD5 e4c6de27d3567d3f96aa1e8360c8f07d
SHA1 d0a363b1937d2aa18e04a1b9ee10c1864d38f6e4
SHA512 580712f9719cf94acc59a819286b61cebd0ad68557a43d0fc50ed7be58f4c5af116dde3c76307bdcd5d00bda9c1b7c5bc577df91ca8b62645e6e235b237192d9
SSDEEP 24576:eAhGLJIFoiwtA5l7S53lnQ/tbw/2Mkjy6Fr7g0o5:eAMyFoiq51Q/lFTjN4
TLSH
T1EB35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2ee3e30d7bd19d0b217ffb111a8df22b36beda148ea7a904252d988d65cc170a
MD5 5e58eabc6e23a08dcf94d209aa6882fc
SHA1 c0caa431ca4effeb39ccd050c19219be17f8307b
SHA512 c09403d85a6d174c2719d9ed44f14b19215b7a20a683846c54e03650e3a65e987fc86ec5255e6a9c4cb5c26eeec2db20a8318259c4f54cbee592bc5d6aab7668
SSDEEP 12288:Zmw5HEjsChN2BFgl0WDm+ChGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMe:0wuHOWenQ/tbw/2Mkjy6Fr7g0or
TLSH
T1D065F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dcc2a59bb184974e8de46af8c23fa5fd6172760f4d91a06a3a982c81b309ce38
MD5 c74ecebb5a35faf2c5e137f0c9ea3525
SHA1 47c007d9ea2e65538ecbb0f20834579a893aefcb
SHA512 4ae01adddb99b4b45baa22e4695497888c51f2bfcaa4d214a5759723d29a3e82baa834720b14a98bf1ea6dc96ddf3e1f30c48e6d5c7d826ae1fe3b4134a96811
SSDEEP 12288:qXZ1IyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:iZu7nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T17655126937A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4bd75339711c55c642ec1beccf6786d7b0c616c8b0a1ea4f2f6bb7b3101b785e
MD5 af8671291f77963d579d7cb1cba4bf35
SHA1 3747cf10d683c6fe34ca7d80b385fc53431039af
SHA512 0c357d149d35b2f9f5c3f77f2e146eb06693bafece99dea8aaa5955abea40ebe496cd7d2b1cce0e3589d1333963869084cc6ec831edb763d8d0228348dcf9bdc
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:9QRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T131666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d4093f70df9e8c063d3aee3abbfb0d2dd229e27654eec005cc1a2c0ee7a9ae1d
MD5 5ab8616f8ed5ecb1cf8779f082dd36ef
SHA1 780b70c1762acd44be41385ff3ef9eb993135fea
SHA512 0e08625ed4a38440f97b0f38edbf118424435e5ea5187b7d24a4d55719a24ecfc1ba4c242811db9a13cdde175e560b665fcff3bf2f3e9191dc0ccc985f965c06
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:8QRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T1D6666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bb4d20daba7146661bf927a198afd8446ae47026d1fe7abaa3db348d245c7d01
MD5 8f4738083e6848f22235f1e784a492bc
SHA1 5b6ba5c2267ba290a9236aadb3c7c8e22eeee519
SHA512 86ec7a99c818f1f74cfa6447672d3893fa9aa3502c826945f6311d94fb841e7c231ff3d772e4414dfddd0022116c503eeb8e63f03f1100401e5030df194b1c25
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0LnQ/tbw/2Mkjy6w:+68Qg55nhheWu7PNU3/6Q/lFTjN4
TLSH
T1BBB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bfefeb9e8ea0e93d35116ed54fa661213c5dece41c2bf43f06b317c8099cca87
MD5 5f68b79f03ab99f8f3061d3b0fcb5b6a
SHA1 f8314e55ad65ed3cf66242bd9faaab4f7ab5c5e3
SHA512 3f6253693ce8f82d3f666100cb7d127e0c856d5f6df675b772697035f1edd9925fe798914a68abece767eb7cf42169edb890cdfa4a26926bbb235e39f1a55f47
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Y:+y5112gYy5azzVvL69nLKnhZELm
TLSH
T19E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 602993dc59166afc1d0197545f978fc10a83d10a9c85b642d441254761692df9
MD5 6effbe95c7a2d09c4c79b8cf96453360
SHA1 fb4a60e1114aef8cdb3ef0e1da4416585b38c799
SHA512 f4e9d911baed4290ca4fe5a23ae021931aa71aadd6a982685da51438ea1da2f51170cd3363481e50944c1c48c518c033f84af0c1ab18880067bb341ac9b5c90a
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glxQ/lFTjN4:3u6JmVxd2dWLm
TLSH
T1F7D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 efe09276ddc8fc0934d80967f289b7110036ca85a967d73f6fbf404045e1970e
MD5 69223063da69f3f14003f3bb15a721f0
SHA1 074be123caaa5486a5da91de4d9677ef6d727fbc
SHA512 4567ffe1aa65bed301cb948de0f8e4cdb9b6bc41dd2f50333a8c9dfa8c9e4bbcf466972b640a13086229a1929f1c6e32da96f37eb076879bcda64b1dabbeaef9
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xkQ/lFTjN4:XmifPbRqLm
TLSH
T150B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7d67f356454c6edf264f61a951977fa7640b72bf8284fe1ad77b05a8beaa437b
MD5 fd5a48b61082d4eb037a014c8b16f9e0
SHA1 4c8641c577d527186be724ca7e2223e1c25f3afb
SHA512 c0e77c38f8f79a1db042cc7e89681356b7da83e6364b99a6e45cdf3aa3e0d0422efc47fcd6bdb775597ba567c0e2f157da993acd1a152f7766e963cc7ab9a7cc
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHq7Q/lFTjN4:r5dKTi61wLm
TLSH
T19FC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 51fc074eae1f13ecddf72cd5c8f6c2458f4d8b71d332622122257b59b3740eba
MD5 4ec3d14b2fa8a8147cb23c6b968467e3
SHA1 5ed272e32226e77f2bbfe95a6d14954041551b2c
SHA512 5a589566e73b0ac467ca186e1b7bda4398b77e759ae1f3ac9e01e620ccc714f20e7c6aca06263a6f7b9edd39725650a4349bd572ee2fb33d9fbfc6464a387a15
SSDEEP 49152:khtSn8EApI0figngiDn0AP5wwQ/lFTjN4:lX2iyphOLm
TLSH
T1BB95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 547d9bda7a1ec13e540656448d210f7547339f208d612dc5954ecf9ef0bad29b
MD5 34443f67ca7f1d58007d15fd2060a99a
SHA1 eaf299259a87b6f5ee5a31f6aa12a7617cae610c
SHA512 cb59683f9c42bfe4a2605e773bf067ea78f5ec28fa0a8780a3f5e9e7f44316a38f13aa040edb528faf18b250151e266147ffe749766f63531b986b7ff454f772
SSDEEP 12288:R3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:RXnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1085523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ac9ea431b1941d49bb9b1e1b6e9332aed1fe5144778372058090e6807e8a4691
MD5 dd0224aa3a13d58306952f71729acba7
SHA1 cdabf094b38dc3c4d4eaa8ab0f8d79b62d40cd4a
SHA512 dc07a05fec0dc4310730221539c18e7ed2b779796cfa89dc56c2afd3830f1d753baf503b9059666b6b65730f36244bc12dffb54a598c9fa1b642de249d1c30d1
SSDEEP 12288:jWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:j2nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1915523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6e6e411093aecb5917354ca81bda7ab3d0a577dd96eab1bd3cdcfa3094ca4e01
MD5 0945997163d8133b78bc26b38d21a78a
SHA1 d54abccb54f028e327bded3fcbd32b06b207bdf7
SHA512 53f2d1d92e93ead9b72f779b2ed7cb32975542f73ae3374d4fd5cbe015b1977df9483261b0292bdb7629753df7e124ae40d1b78592bd4b69c02460aeabd2d11a
SSDEEP 12288:4sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:4snQ/tbw/2Mkjy6Fr7g0om
TLSH
T1645523697965F98BFB1706F148838182973B0DC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 bf366e008f2e325909860a5a305bc7b8dac8bb593c8f88d30062a03646e67677
MD5 c0f16baf3214a129c76532700d8c1980
SHA1 afb7a039ac0fe3a6586217da31259f565f5ea758
SHA512 63c35f325e5e9b28d2bfcf464bdbd9e7a126dbed8dcede3d0cb574a53a5a1b72d1ed7dbb5ca98713cb5fdac642681226b7dcef594a363e51dd22fdde526e9e7d
SSDEEP 12288:MVlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:gnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T18E5523693B69F4C7F92742B4CC928142E77B3DC6BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bea8bab8434a24a25e81cf82c815001ded965e7a10d8bf21fd25602ddd7396c7
MD5 782f34b5bd87e2d074fb15feecac2516
SHA1 670409fdf3a3fe921fbe48ab0ce12b983c35b798
SHA512 31fc812ab7ae170bce961a5454817886ca21261e3983a3484392cd3d6431f9484303ac164970c63a66e5c14a712e2a54c3a77c32190c78e7d7e9ab31f17e007a
SSDEEP 12288:79GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:7dnQ/tbw/2Mkjy6Fr7g0om
TLSH
T11D5523697965F98BFA1706F14C838182973F0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7939331f0a91706f3c9a9bb7fbc93e5203286033b7dcab65a4b2f456db447418
MD5 d9771217f1a6d1fdea5fa197e4992d23
SHA1 2f6838161c6cc94498d90ccf73d5eea6d2315787
SHA512 725c6d6546a1ec4176c396846853b96d42f73e641844d8b2778adeaf795e37314e59092d42ea306397508017b42943402e0e2a2644643ddb72016f39cb92be4b
SSDEEP 12288:MyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:MynQ/tbw/2Mkjy6Fr7g0oC
TLSH
T16F5523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b2a607f61e58b358704f2df0397913ec94092faf89bb12425b7bcdcc9cb6e35b
MD5 9243e9206e6755a271bf899f803bd3d2
SHA1 49036c7f97ba2d53a33aeb0d3f9c7127b640fc2a
SHA512 92af92ee769f85f08e4e537f78d087de8d8670ceb4217705d255d6e0ae90d2a88f1cd7a9c8e2046e529908b31d6eecea0a3e8c88e4f489d50183db8bcc6e4a58
SSDEEP 12288:1uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:1unQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1EA5523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7588d6e9d5e9f73c4b8d81f563ff5d8cb72c1c781886e27e3d655ea668a8c730
MD5 a1a093e2df22d04c38c2d18983e2d0d6
SHA1 3ccbbe42e56af76b0f9098a06ede9f4f8abded9c
SHA512 80323bc9ac0a7a3c2347dec3755979d5392b59b68c354ac2b088383e056a10df2882d5028576ac3e7202bfc26c19807f3877f9da100d5db100f9fc572dbf39ec
SSDEEP 12288:jiZwbDzzFEoS2cPvy2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:OZM3zFVSOWnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1427501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cc68a00fdc274a8ec652022426a759f409152b252c19de4ae6acbf649cf1d289
MD5 5f84c781bc74fe428e11210c7e3c601d
SHA1 3fece60409795eb9a5ef63a57d3c8bfd3f51bf6b
SHA512 8026ec33f46c3eea9c9cb9d91203a05ac2a8fe121dde61f48f67a459b6d292f37f26245b102fe356cde60e04895e3a11d6b334af5c06fbbfc26c611a3de06688
SSDEEP 12288:n7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:nrnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1795523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f5e4df25fe1e68ad361ed046a1683055e606878ad71718504780ca0f6d861457
MD5 54fec9bb09c0fb612e3a5144f0463fa0
SHA1 02a7b94d9758fa73e4f43535404ca5dac11798d2
SHA512 0d028dc3ca264a2971b25b5c5b6c1354c535b99d2a44782ac8d986ae4323ca98807e9429903a8bac0fb3cae6316d0644aa54ecfd16be6b381966538b170c77a8
SSDEEP 12288:8fGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:8/nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1C05523697964F98BFB1706F1488281869B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2419a0625287e22e43d4f4bed490dedc3709d8e029b8ef8ae3945ef96364c220
MD5 76b7269145af5c94da18c09682c7cb46
SHA1 050a9bfef2ab9ae1ff78c7f13ae5b7219ab35ec3
SHA512 1ced08facf55589b1e942cd05f75c465f1af9e03c33d7d85bb2814cb8332f48072fa65df8c16dba37ff7c5fdab8f0c4928756477c6a3a394988960f2c3bee928
SSDEEP 12288:myPz5L8aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:bzyanQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1B065021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1462b75c2e7a6d91fa5fa2ad8918bfd501c09899bca0498136073982afebd609
MD5 e825ba2784c70cf109d82b8c9ce82f7e
SHA1 c37f2919e239d3e5ff4d0bb05873fe5cbfaf78d6
SHA512 c3e6d2b7dfd684d128e9c8e4acd5f1c502a665791d994c87eb59692db99f97950f2a2069db773aeff26347e9466edf32e4c26a802e50a31d78fe31a4029962df
SSDEEP 12288:I7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:IrnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1775523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 770a755dd0992150c76cece6ffc50a2c84116723dddd3b02a40dafb34599de2b
MD5 730499dab0811c709fe112854a458295
SHA1 e972f07f02fc3a5d5d5129c0c3b46d6660020d8b
SHA512 d0854e37fbab2c539fced4e6f42c5a1f59f4ec9454bd6f66019cc9a8bede2eb74f8b34064fd28a12b253ad9b0e8ba36457def122d56df6d524ebd83b1caa2f06
SSDEEP 12288:/7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:/rnQ/tbw/2Mkjy6Fr7g0os
TLSH
T11F5523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c8fc98b8010a5c6aaf3142b7caaa8e61d87583d035456d5de980cf05ddbef986
MD5 a3ebebc0195a94bd2f0b326f88631eab
SHA1 ad9dd0f9644170d42be5738d5d26aa17f894a72a
SHA512 04c7ee7b359d3aaaa1898f7180c2f6cbb55a9e693e823f3216c410662751763bdee2d5cfcc005583e80cc8e8e0e40ecc99b9c217ce3c4b972f378845b8d97a15
SSDEEP 12288:XyPz5L8aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:azyanQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1D465021773A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ae0b63bdbf9721081ae090b349f259641e227305e95e3d710abe563f0a840916
MD5 6f590da8a4cba4f5ea68a59d42126ab3
SHA1 42721197eb2f0f08058efa9c74a910dd464e2211
SHA512 ed81a02e232e83c41ad986d1061c088c6ef66d07b284b27f1cd4b219ab78b3daeb1771f35d44d03c22480e77e856b716faaba0bb080adc9557fdb6dedab0976a
SSDEEP 24576:WT0aLl3z0zD8nQ/tbw/2Mkjy6Fr7g0oD:WTDLljRQ/lFTjN4
TLSH
T1827501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1fd720a282a2eb812b7636dabdb40333fff08c3b957b3928289eb8572dada3e9
MD5 0837a8195a9f07e86f20ec77fe47c26b
SHA1 b084e2fcfbdee96de7a09e57592f677843c6f759
SHA512 93348404fe86c91a8127677eafdf8e911286826aedd9494dcabdcc231194cfd20414e4347723581f8040b62a55981e52f0c039494975b437b5e33826b48abeb5
SSDEEP 24576:p31d9CHKy7GZ4nQ/tbw/2Mkjy6Fr7g0oV:51d9CHKyaiQ/lFTjN4
TLSH
T18385CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b8d955be445d591eb0169ee68d6dfa938a6d198cda855faab2182777d61b364d
MD5 36f4cc60cb537123d39e4f0bfd4ff02b
SHA1 bf488fecb6bd309ae058d9984bddc1bc789df577
SHA512 71c528867a5d4d2590f3e8a45898bbb39d32beb5b03429a499f2f559543b40a5cb8d72c522b84dba6609f6951713e25a47490101ec3f5a789aa364e4a8202d96
SSDEEP 12288:9MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:9MnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1F45523687965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0dc9574c8f32eb104c05b5e42196e10391bba61f6cc072ad1d0fdbc02f22ed0d
MD5 b2dd6e7b51aea85dbed4075372bc6a65
SHA1 388a425fdcc7180fce8fa3478b7aab91f45877db
SHA512 2bd20d6b63667b98695701595de58adb8da9bd772117cbd7c4ae82eb0d7f0100bb6250e83fa0a09d561e2cce5296d87478f633d1226af3dc40a06ea4ab72df68
SSDEEP 12288:/6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:/6nQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1AE5523787964F99BFA2B06F14C828182977F0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a9314bf6f9f4abe33e0a0579decfda686b220a8eedbd14f80e55d8b746118307
MD5 5d471cdc0ebc1370f1adb2092e2f4bbd
SHA1 7d9b2921795731420e7135f3fd3bded280ddced6
SHA512 5e9bb5e00cc6ab19cdbc1baaf1ec7f5da91b522694a0559d8edb57406607a243a706064025033c0c639e10f3b2ba2d3467225753e843a80e73e5a249b2125cbf
SSDEEP 12288:x5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:xJnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T10D5523697965F98BFB1706F1488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3d7bb42db952c6b0114b8f4cec1b095065faad1b2fff9ada00097df5e09e277c
MD5 8d2f5b7e29a2051392da4267187a2cc2
SHA1 550624625e378301e0bc460837fb7658b9dadbdf
SHA512 3d08f3001d9220440496f39ebb78a386dd80bd744f4a7192fec4943566fc53043ffade8d92e3531eea983ca8a9ce4a3a31f5b3c842e76cfa3c07d683e8f365b0
SSDEEP 12288:vssfLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:D7nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T16765F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 df010540e662a294d5c208279aaff8b24a029343bd29a728a51700856ba7c180
MD5 c19ae08041bd22bc0177276388d3db39
SHA1 f707c1425f4fb7cdedc525142917fe7589dbbb88
SHA512 ce19c752c2a363cec1b6e8643f7019f20f4cc0d966c2a666eef68d7be750308e66a35cd4beb6c71c10ad511c938bc12fa2733147adf2e68500c41e495852fa97
SSDEEP 12288:rtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:rNnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T15C5523696768F94BFA3B06B05892C151673F0EC5BF90D38FBB08222D957C3D01EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9e866d317daa983de777d6ded79db1ff2e712629e441b431cd0459a8b12f8716
MD5 220f18b3dab6e281e085bea4abe23eff
SHA1 40fb62f031febb11ebdffc7334299cdf7c70cb1c
SHA512 99f4d6256269fc62a396cbca71df8bdc7b581215810883746fd992cb39128f11613148feebca1a2376cac551429b83c2bc5015168701db267a1c580c065dbea4
SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQvQ/lFTjN4:qa0hNYG4JwrLm
TLSH
T1D0859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 6abf38da2c6536f03ab2c49c8739a03b88c6cfe2d1f0af0fd9282ca5d21717b6
MD5 fcbb5e59c5b965cf203eeb1f4d75caf7
SHA1 22e59ce9b37593a84bdac95bddec494a52ccbd5a
SHA512 e6689d35e3f13dd45e8723ba70bf5083b901fab390b28320c76e0070bd88c13280ae4aeca37a9c25706f156e97cf8f02508f8507c93e29575ac03d43e3e41eb9
SSDEEP 12288:yhbHjfX/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:yhbHjPfnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T13F55027E26AC30DAF63692BD88928546D7327C552B11A3DF2381427D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 dffc65f76b8d665bb249128a3bb89a9da45faaebeb665adad53a6281552b4caf
MD5 086651af4e30794a48170c33a0aec909
SHA1 0aa66b98363c5a697541439d3c5976b41dd3391f
SHA512 ba994e667dd3b705d4b456b80412831c8b1ca28c3f361791367b511b310a9fe869dd95dc865767e2d3c23cf6d8db296bea68099d95a25e5a9074f22368c61e87
SSDEEP 24576:y3YgnJcRTk4yti+R5dBR/XnQ/tbw/2Mkjy6Fr7g0oF:yIgnaTk46pBR/XQ/lFTjN4
TLSH
T10A45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 24cc3fbcd0af1dba4991d512f9cf641fcd79a77c4086d0e32b8a11c65098599a
MD5 49e8bd4c767ed979066a49b9db46d74e
SHA1 d330af602956eec2dc6d34157e5b46d6ecd76d2b
SHA512 c6ce6672ee07e34b87d1af79c507d5fced7977d2e60d40103c5e84ca3a4e7387f2ac947b2eb6fbe59adfb29f78edd998763b5fd984eeada82111a885caaedbb8
SSDEEP 12288:KRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:KhnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1D25523696614F98BFA2B06F54C838146673B0EC17F9193CF7B482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 6015200f3aef6ffd1a7808243c1ed816b487864b4b139390d9855f4132349b95
MD5 d316534cdf5605b3a44f76c74458e907
SHA1 78c984e0107e5e3d199e7287c0234fd8ed6548a8
SHA512 34b7cb7ee1985ccfb90458c1e53128b2ee7261076a9aa2f180fb61f7485426f7c7abe4e58f839a01176f34034d7472e9dea64936bf1343d627e14279411b8659
SSDEEP 12288:XOb4A4LWOsvAYFT2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:4wL3UTWnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1A175F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 bbb7aab6ac32c2cb055fd2e80f1814d8f6dc4bbe378495b5096c098f6bb543ad
MD5 7d59ebee2b1081e78d1d8b91e2bd28cd
SHA1 e5a061695e54d41e03a96c304a9aaa88ef4d4805
SHA512 a864da763fc19883ceac2943ddcf2c3d19a67b8651e2955ec30f0508eb2c87092692e957c3db4292e4e850d740a1179b43fe3b33313e2655d8c55047b5a5c22a
SSDEEP 12288:DpFtCO6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:AO6nQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1B855022D36EC60E6E536527C89838249D37278961B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 801c47c73b3544439d0da195c5c8cd7a22984d59c7eb1ee43d0ec6a358f1e4da
MD5 7eca6711251a1b7143fe761e4bd766d5
SHA1 00fe51bcde0058ea1c6a7d4edc0a064d47e74302
SHA512 c5c2dfb83268fb5930ffacee3d2a318d22c3f0a55f9f74d32c47fe83739e223115330799ff29f453dbb7b153de61dd644e327763bb0c043fc5b36aacb18b12a0
SSDEEP 24576:L7NM9YqZqmWMUkPjZM48Mv6bEhs9nQ/tbw/2Mkjy6Fr7g0oN:L7cBWMpPjN8DbEh8Q/lFTjN4
TLSH
T15F659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b2cb83c5c683f95629049817cd4d411fd19fdbcc87e32fb750c8519a6d655873
MD5 89241b7efef047a05c23e56bbfbbcd12
SHA1 778133692afd1520bdd62d85c6fd58df9eac9fac
SHA512 10e58d6001c12c7da0fedbfa430dc5c7d528021fa38bb028d450c3a86eb1f20d417c49b169dfca47092c98623bb254f41c9676e42ab8cf3013324a85530e45fb
SSDEEP 24576:RW6BApg2YuyuNDYTabvcdvNYf8km1rnQ/tbw/2Mkjy6Fr7g0oj:RF2YuHNETovAvNYf8kmdQ/lFTjN4
TLSH
T10B857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4f134207750ddfc78ae067278ea7845199f5fd25f0e82f90d233e3c1041cb94b
MD5 4fb61e4d7c9b31d7664b6dfe9a834042
SHA1 3fb3d6bed7152dea1b4817f4c9f31debaa650c53
SHA512 1299de5d7baf441b44c118a3c8c54732f1e767293c6131e77267c458e3a88b1d1b59b77a536de89a360c66c55e1cacc3385330212cc52971f186fd9a9d736748
SSDEEP 24576:iAFs06+Omlf3NXEbTo+nQ/tbw/2Mkjy6Fr7g0og:bFs060lVXuPQ/lFTjN4
TLSH
T1AC65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 d6c28b65c65fae43705faa70db124f28ca36cdef9432a93326d494708074fe2c
MD5 fef15e5a1cec8cf4e5fe9740f21c0b7a
SHA1 96e1929e5d8047d870d4c8b5f4904e5d13c76f13
SHA512 63f1a8ff9d35bd58d5732b50e3b4bb4e23b38d004641924b699385d9436d024837fdec7a6f39cd51cfca3538d14f52fa86353db6673d2eb9151c149c6531aa41
SSDEEP 12288:uCJnJ5D3Vkrqzx9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:/JnJ5D3WaPnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T15475D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 edd64bab2237a95ae5ca1491e0b46278e2440607be8af447c5eb30a1e7666077
MD5 16473a8b9c64c7b8010b7c7188059be1
SHA1 0b4e1df523e2e0da609c0ac5b84042585603a710
SHA512 4f4f9c4847bf9e68d056f3c8e89401e8b05de1f88661733e2296cb044b90803c19366f9f79b9b24b121669687b196d7647630c8bd7c6aca3be76e018debaeb36
SSDEEP 24576:6EPghm6/7IIXdwcXrif7qQncjlP65i3Vu0nQ/tbw/2Mkjy6Fr7g0ob:tg06DIKdwc+eQnSt65aVJQ/lFTjN4
TLSH
T170955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2f4bb2778ad53b3b9e96a5715daa44b8de6a39098d20a9f756a55deb47646799
MD5 ebbb87041b8cd2bf0df59799a980d738
SHA1 d1fd7583b9fda2d46853422b12f61af0f5b0c519
SHA512 cf15b6100353da28f66e45cee0423cd90666865c48646681399a8ad3c99fd8a81c400dbb765c78ff1fc0c7822ba991c2cebca0b56e9388d58cb96a64d9381ad9
SSDEEP 12288:rEP3RS4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:wS4nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1B255126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 fb1ba80ef13d63d837e39059c38fc20cdcf815428f7b22e14d4d120c3cbf66ee
MD5 9dd330f886cc8d7e70f9c0f3392466ae
SHA1 8bbf7017d8ae1412a83a678303deca14af5d5021
SHA512 505901339b4a25472f3b64caebc0516fa687dbcbd2ab8e86a7ce8c4efdcf2056d5138b1b674ca94bd38b7ebb51d6583dfaa3d01201bced34ea048cc06eacade1
SSDEEP 12288:ejkyPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:eIyvnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1726512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f07e6dadc46a96673d38db85d4aea87f3ccb754a1f5ec34c4a35d9d3c018ded9
MD5 e8575b5835f60b5dddbca9f60b635d99
SHA1 83dfda333d4027e47bebbdc1bfa9dce2622314ff
SHA512 931a788bef5f074709edec151366c9d590a96ad0cb20eeed13f83285643650a7ef9904bf891fa6755fa4f99f030272aeb86aa65110db408060235594657e400a
SSDEEP 12288:q0KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:FKnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1BA55236C2625F89BFE2706F448928542973B09C17F9167EF3684A239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1af4b874105c888cf40000d6358e49489a8c26e87c0df98ef16e4d6d7cc881c9
MD5 2c7cbde429e312c1f080bea9bf856d1c
SHA1 2d21685d06e9b83507a77c185a049dea0ba45468
SHA512 6a27edacc478b2df57276feb93113075b3a27bc808d4923e51f8bc82369815700b1adabd6dac0c07be9f8f78ea0b107c24da24fd7cd57be55f00bc03c3f2d764
SSDEEP 24576:3Q9MxZKdcz9dw3FnQ/tbw/2Mkjy6Fr7g0oC:3VKZFQ/lFTjN4
TLSH
T1FF558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 7e592911082d5aae7677eca497937f92557ab57e1f054f411e74330d09c0b3be
MD5 36b7feb49ac14ce6bb845885511a020d
SHA1 93fe4019477a1f6af5680c25b678ed132a9369d6
SHA512 d16185099d76fa300eb283be95bf0e15c458aa1619596361ebc7b25cf0484c3de7666fdd22c4d6581806d62705a8ec482e6d395aeb3fad316e65fc19751e926e
SSDEEP 12288:dyoKo20Rple9pwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:dyocSApQnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1FD65E01FBB6990A2E136813C89818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 46566663230a8d5d7cffc936b478b2cdee45d9cad2ac158c13a8ea2ebb1f6163
MD5 85163ffa7e6b9322ada108c53e427908
SHA1 ead00578d01c8bae322ccc5d93815688233dd0c0
SHA512 cc9ef8f3a69da1208b949f6dc9e278f20ed1117a7c4fc04695ad4cab0d3d18120ae5997f08f28a4c84605b1d76ed2a64ac0baae5541e0d8ebaf405640cbad873
SSDEEP 49152:NWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKQQ/lFTjN4:t0zuNIhLm
TLSH
T161A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 59f7e3a4396e2ce11812400cd3d55ff941a6c62067c14629a326ce1f321d908f
MD5 58cb8c3acbb940fb44adc7469836f728
SHA1 774f5460ecb522e1243e62b50ff5238e97525b38
SHA512 122ef1363f85d19da791d76099fc5113db162788f75c94742ac25801c19fa23d00d0af67436bc00cab3135348cfd62362352ed1c95f65d39d198fa994e46614a
SSDEEP 24576:D1QT7EcpfxR+N5AWAz3ooiYtjMqb4nQ/tbw/2Mkjy6Fr7g0oH:eTDxR+N5YzTfjMNQ/lFTjN4
TLSH
T12255B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/372-209-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/436-407-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-418-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-434-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-426-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-427-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-428-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-436-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-425-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-435-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-433-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-424-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-423-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-432-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-408-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-409-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-410-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-413-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-414-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-415-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-416-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-438-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-431-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-417-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-420-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-445-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-446-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-441-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-429-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-419-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-421-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-430-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-422-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-412-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-439-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-437-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-443-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-411-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-440-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-444-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/436-442-0x000001F03DB50000-0x000001F03DB60000-memory.dmp

Download

memory/988-319-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/988-521-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/1192-238-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1192-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1224-275-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1224-397-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1480-472-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1480-316-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1536-405-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1536-301-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1848-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1848-210-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1848-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2272-278-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2272-285-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2272-279-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2272-400-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2296-208-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2296-81-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2296-75-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2392-38-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2392-207-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2392-32-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2412-269-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2440-406-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2440-308-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2504-248-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2504-254-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2504-247-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2504-311-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2832-271-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2832-401-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2832-323-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3104-312-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3104-471-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3184-304-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3184-306-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3220-403-0x000000000CDB0000-0x000000000CDB8000-memory.dmp

Download

memory/3220-324-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3220-379-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3220-522-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3220-363-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3220-395-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3384-8-0x0000000140000000-0x000000014035C000-memory.dmp

Download

memory/3384-6-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3384-71-0x0000000140000000-0x000000014035C000-memory.dmp

Download

memory/3384-0-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3484-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3484-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3484-64-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3484-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4116-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4116-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4388-298-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4388-296-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/4388-402-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4388-290-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/4424-260-0x0000000000840000-0x00000000008A6000-memory.dmp

Download

memory/4424-264-0x0000000000840000-0x00000000008A6000-memory.dmp

Download

memory/4424-258-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4424-315-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5072-24-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/5072-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5072-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download