6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.9MB
Sample260823-g22l6stdnb
SHA256 6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e
MD5 7851ed616ae4a57bab6578e74f7649dd
SHA1 8958f07662fd34eb8557f916ea021d6e00eb1aca
SHA512 4a841894098dc604d019bf85e7a83ae143405b9d70f0d936827d004455f82753a2ce3cf5784a702b948d69e1baebd763f8214e404ccc492b1170ce7c8d41730a
SSDEEP 12288:K23Jh2CPCcnWZ9bv8XqFS2yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMk:K2LlQvkDrCaEzwAyujOhcid/RrmpF
TLSH
T1FF95BF0267E505A8F9F7A73899F69121EB737C855B38C64F0298416A1FB3F80CD75B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe

Executes dropped EXE 22 IoCs

pid	Process
3152	alg.exe
312	DiagnosticsHub.StandardCollector.Service.exe
2756	elevation_service.exe
1700	fxssvc.exe
3956	elevation_service.exe
2284	maintenanceservice.exe
4504	OSE.EXE
2080	msdtc.exe
3740	PerceptionSimulationService.exe
4728	perfhost.exe
4224	locator.exe
984	SensorDataService.exe
1756	snmptrap.exe
4140	spectrum.exe
652	ssh-agent.exe
2264	TieringEngineService.exe
1700	AgentService.exe
1580	vds.exe
3156	vssvc.exe
2484	wbengine.exe
5116	WmiApSrv.exe
2608	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9bf56ac63a3ba122.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cde0a8cc732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7232d8bc732dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046713b8bc732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080c12a8bc732dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067d9e08ac732dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e9ce58ac732dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ffa448bc732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000264c158bc732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d862f8bc732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b033bc8bc732dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
312	DiagnosticsHub.StandardCollector.Service.exe
312	DiagnosticsHub.StandardCollector.Service.exe
312	DiagnosticsHub.StandardCollector.Service.exe
312	DiagnosticsHub.StandardCollector.Service.exe
312	DiagnosticsHub.StandardCollector.Service.exe
312	DiagnosticsHub.StandardCollector.Service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3216	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	1700	fxssvc.exe
Token: SeDebugPrivilege	312	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2756	elevation_service.exe
Token: SeRestorePrivilege	2264	TieringEngineService.exe
Token: SeManageVolumePrivilege	2264	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1700	AgentService.exe
Token: SeBackupPrivilege	3156	vssvc.exe
Token: SeRestorePrivilege	3156	vssvc.exe
Token: SeAuditPrivilege	3156	vssvc.exe
Token: SeBackupPrivilege	2484	wbengine.exe
Token: SeRestorePrivilege	2484	wbengine.exe
Token: SeSecurityPrivilege	2484	wbengine.exe
Token: 33	2608	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2608	SearchIndexer.exe
Token: SeDebugPrivilege	2756	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4248	3216	2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe	91
PID 2608 wrote to memory of 924	2608	SearchIndexer.exe	130
PID 2608 wrote to memory of 4896	2608	SearchIndexer.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-22_7851ed616ae4a57bab6578e74f7649dd_cobalt-strike_icedid_njrat_satacom_vidar.exe" uninstall
  2⤵
  PID:4248

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3956

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2284

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4504

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3740

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4728

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:984

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1756

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3248

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1580

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:924
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 83043655e5dc5397e863805144aef48764fa41dbc57854efc95586c76be184c3
MD5 d8c8bbef7ef8fbe4fd42755d14f951ca
SHA1 57822193b5c4fed68f7b8b320218380643c1ac8b
SHA512 d4a7d1b9a5663c22256aae16867332397c0354cb6cc49072e7ac520ef23db182dadbae555dea392d1f3727d7c6b17fca0d14e5d481f982df617741fb28d34f92
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuCaEucW/Rrmp:t3q6HjBqnudRSp
TLSH
T1EAD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 17b663da799ba7352210d3d97daa3fabe86d2c72c5291cae15edc5fd697ed509
MD5 aadcd7becd4ac5c89165da59dbd9be14
SHA1 819f28d507cd8fc660ff19fbffa1fc9afe627228
SHA512 74bca514cc389af2ec5d46bc1417ad9a675ee35c08ea503ca48a332597647a7e9daf80959aa25193603da8535224436b3fcf8b174452b2992406d67f40ca145c
SSDEEP 12288:h1XLsswWkxy2lRq2czAuyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:PXYfDtczADCaEzwAyujOhcid/RrmpF
TLSH
T13385F129B7D409F9ED678239CCA28111EB733C5547A4E7CB03A8A9690E333D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 7f165b8bb6c04ba92b723a13798e38f461b18d64692ef7acdecaad7aa576fc63
MD5 80c7a0840cb808428fab194c3bfbbe90
SHA1 f527a94da28e1e9fe86807d494dbd13c28eb1de8
SHA512 a16a971c3ec6055dc9e0f8f1d5026853ca3a64cb0c7bc21ab179abf138be98db65cebb6d04193faa571000c4df1f6263879d912e4ac94bb89d12956016d27661
SSDEEP 24576:o0Le5ji0hmxCrMGCaEzwAyujOhcid/RrmpF:oPji0A8BCaEucW/Rrmp
TLSH
T104A59E26F6748331D073C0B9C5D2A69EEE71308657308ACB4286D77C6E67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7e400f49873dda0e6884455fd73ac0345c652f091059045e1cbbeafe93cafd78
MD5 fb38572b922ede9ccc74b45833e3903d
SHA1 9a34d4f591d83d877eefbae93c3cc7dfd6b8bdff
SHA512 f39fd8947a510baf7ef41f2d64a42da448b8e487a3d04493e1cf4fc8fa1a69e8028e740a7bf7b4d4ed0bda8aa867f70335d4cb2d0ca4b68507d84b6c5648aafd
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyuwCaEzwAyujOhcid/RrmpF:O/ezSC6vUzPvxHjylCaEucW/Rrmp
TLSH
T1A8755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cbc1f7495955b5188ffe2af288552cfc9bce50ec08f0dd63ddb1c44cd57afd03
MD5 84575a3d954b5daee67d4c8e46c2961e
SHA1 005686850c31e363f07384d9b4bf254f56025bc3
SHA512 4fe3ee251dec31e3fbe8bf3f668db098ed62ad2235ed2e299b745fee1a0162ca910f7b7062a11c5b2e30c05e6716fb508b75f1e6c0a3c14f472160efa2d73234
SSDEEP 24576:uVbqPb88hv/l+6PCaEzwAyujOhcid/RrmpF:uVO88hXl+KCaEucW/Rrmp
TLSH
T1A8559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 b15fc2c99c4d7f5260763f5231942e5168b2144d7910f7519e0a1da5fc9bbf44
MD5 ece2c882ba2e93c2b0efdc229f5814af
SHA1 ff08299af0712a7e35c66cf7f78fe3c5afbbe67b
SHA512 c75a9287cdc05b3e6250f63543247fd67484d9535aa9d48422fddcbb4620ce8881f10830b7ec9ce3c6f0e57adb4734a4c3570bd00d8960f7bb7d1dcb1465e480
SSDEEP 12288:cEHyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:cESCaEzwAyujOhcid/RrmpF
TLSH
T143752337DF8997F1FB4A27331CF61024DB562C96159ACE8EB56DF6AD44BC6C0C849021
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 7a968c14b2ea2ccf40ea06ad3702ad38d2614b91ba24d98938c08427631e6e61
MD5 2a9c716a9e647f81e6c0f4eeddddd14e
SHA1 9aa3153bc12878e9854a20bee50ae8ee1bee9776
SHA512 b3c4e3b937e07aaa4012293d5c16fbba01f46e13460f3c1fb6fe3107994e5c88aa6e87cf47e4b406079f3c8af540a14d09c73ca5a07cb82c65b04799f1cdc001
SSDEEP 12288:aeBNUbTVO86UiyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:aJIUnCaEzwAyujOhcid/RrmpF
TLSH
T17C85CF3BEE28FCE2C27E9D795A918200D77278714B6293CBE169C20EDE235D05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2ba01ac84a5eaf029f6a237b92ba259720946fda398ffbb3fe300034b3f259d2
MD5 b36a781c3b78e4562ce17539b90cf799
SHA1 974e04652a6e0dcc9b35034569fe7548a282c4e7
SHA512 706e5c6842428a2155065485329253c182661b8c1d7128dc50c7672c948307346e04dad16738399bee1dba3a21dc519b6bb30c3af71f4407831c3a0e12034189
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:VQvGAdlCEL8c/yRNw5CLnudRSp
TLSH
T1BD267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 9b82445197f194b4fbfa35f566e0c169c31e9688baf5a02fb75837a73d3fc6e7
MD5 5611b6595570da5cb61f4cd3a40a20fd
SHA1 4608d4e4c064ac14656be9034941d91e01b33b16
SHA512 dbba06b10b804947e432cd0017bdbb4bb82b92bd73906351d648194ba21c9f445d1bd08faa2be97e1e9e38d40b0e5468d31f0abb60527c17dbb82420c6953cbf
SSDEEP 12288:+AwSfxL/2Dc34DLLmt0LDQewsAjAyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm5N:jdewsAjRCaEzwAyujOhcid/RrmpF
TLSH
T10195E031FE74E032C7BB0EB21B36C316546D79604B611AC3F3A89E9E49742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 124fe07b7aa10ed5b0b270324ea5bad989587b8f86b0876560c397a611ae6d07
MD5 7c1ca55093655af11024880fb16dc0ef
SHA1 d6b2b922bb1adbaa344e6fd723dbfedb61524413
SHA512 5cec46628ac80908a056866e7eeec798fed093d3d41229431a69583c5a6c019fe3a15d42a642346a0bc835dfacc5260dc8daf1830ff4a9864f755fb6f4d81074
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHonFp:1UEtQevvqc2W1cpV2EI32on
TLSH
T1A2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4213963572d38542f2582daeae3a0873506d0e15e458e60cf513166153f61aa6
MD5 129099eb642e84e706362a7f4489a3e7
SHA1 e0a6ff9cf345e4a6d06f6a5a3ac48266f4eec303
SHA512 fc8db6341ef497447c8518a50a0f10ed7e407ea46e3faf9600656463d979f51a57d595e2fb3baddffe4ea5b8237561a0c5616cfd37822b11dc8675775457a928
SSDEEP 49152:qCbRquA/m2yL5zLfFiV+XenmE3/zxCaEucW/Rrmp:foq2Vjnm/nudRSp
TLSH
T150D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 933398fe3c07ade1f10bd619179e458030ceed3df7fae28134fd319b4ffcf8a7
MD5 cec823e7e3e2d0b98aaf23bd3332704c
SHA1 10101bd8d1d3f416ed3bc30ea644f577dbf9289a
SHA512 1adcb4c5d6e86d7754629db88b59ae5149c65ffdc7e3d2e82027a8abbd3f8518c1220de219af5b272fda4ba9d9c3aef45ef9a0bb49c5143429bb0a75ead0ec8e
SSDEEP 24576:GAhGLJIFoiwtA5l7S53kCaEzwAyujOhcid/RrmpF:GAMyFoiq5UCaEucW/Rrmp
TLSH
T1EE359D81EBF955D4F5B3AB7899B68170EA76BCA65E31C20F2164D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d640087d85d76ec79aeb4591d3f68f774f95dad4adeaa091f74bd4ebcda69ef3
MD5 f061754ab05a986f4350d4da101e6824
SHA1 8ece86dbdccabac3c8f7992ee2aae6d3516f44cd
SHA512 af7c8e9c7705ad444ccf6ac3a445ca344e58deb75d765773c0cc8d1f9dce0c7aab307d864b8d369963ce80808defeb7118881842b9071408c30d35070c491075
SSDEEP 12288:Umw5HEjsChNyBFgl0WDm+CRyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpD:RwuLOWFCaEzwAyujOhcid/RrmpF
TLSH
T1AD85F14A77A80CF9E967923989978135F7F27C022A25CB1F1364C65B5F37360AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 5bcca48d2fd8208c71d1f16daee8ede7333dd5643cedfef26a438e6ebdf25c41
MD5 2b22f5d6bd89cdf3ee404eb6583da454
SHA1 804fb1ec397ffb15b8a49451544d2168d5d49d19
SHA512 6323143db44c911262692d44e1a587bc8fe1436e2f3fc9eb169ee50ddeea78fbb9d308f0c34e46d5d29a3247459dbe8d357970a6b3401cc47f01154a75290f39
SSDEEP 12288:RSZ1IywyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:8Zu+CaEzwAyujOhcid/RrmpF
TLSH
T17875126B67D462F5E697533A8CF10104E7B23C52237683CF2668A26E1E76BC15D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e41f28114f49921b9a8054afa0e7fe09fca1d2ffa4a7d5fc0b07a7d6c14c39e1
MD5 8bbecaf1fa20443fd8ba80b08316dee9
SHA1 ecd9ebd696fceebb3552ec3251781cd42afe0b41
SHA512 869f905aff098919229892a370578511f957f39aa3a0d96d580fa757e2756526dc97cdf93196f21a0552d12cb54d736a8a81fa72896426b642f78b49324bf953
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:PQRQyi36YOcPQLvw2gAf+PN3GnudRSp
TLSH
T14F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a49eefca853640b7d6e02e1283c5fe586cdc5035877180e7d740018c8842cf11
MD5 7865ef7474a65b5ba7ba877aa9845b3c
SHA1 36206eba3189fbae2bec457346081622c7f8a734
SHA512 c234dff3985bfff56d16bafd85c58c0499a73ff334e20d26790dc88fec0cfce99ca8650e3a21835476579c3df37305df62bf0664fe86abf3031d4085af8cf4ab
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:VQRQyi36YOcPQLvw2gAf+PN3GnudRSp
TLSH
T1BB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b32ba18aaede0ba272c4c390032c030c07de34572e41f22eacd98f614ed8946f
MD5 c485c408cae76cc71211f9a9c7757547
SHA1 aba87f8804c97180fb47d2e4cbac36d740aa390b
SHA512 3f09ec161c7b1bc8a42808d4b37e5ad353994fe543f5a681dbaebb7a207c2d1f68bfeed432e8a59ae7467cf33351132409df3390e159c584f98e0306c5841571
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0uCaEzwAyujOhciK:A68Qg55nhheWu7PNU3/BCaEucW/Rrmp
TLSH
T139B55A33B2F600A9C44DE1769F4A873196D27C758FE0D3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c8607ef03c510d3d4a646cebb9fdec7160f8a361f3a4374e6b071c606cc71ceb
MD5 e18e44614ac233e853f26ae867a373f7
SHA1 d730afc4b05037991f68f2d49b071efd971270f9
SHA512 581003b45fd0a1b6557e6d7ac380a570788c985ba2a9bbaf2dfc9421c9cde36c59dafe0aa47776e275fa99ae207cd80f28720f9ce8245568be743b3bccba303a
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk992:ty5112gYy5azzVvL69nLKnhZBnudRSp
TLSH
T18D168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 24eb54f832b75c9ddf1fa1284e50ca5ce4465f9fcd1292f0113d57d477ec63ee
MD5 07b3edc903ba2a86eaf87ba90c1456fc
SHA1 84fa251cb75df61a2e590ad33b1ee29b4686f162
SHA512 baac9c49d4f940009c647c417bb999cdc6ef35738db4e5cfa4e4d9a8dac9ad43494972d5deef72946099737ea149f2ea79d4313fe61f40f52d3d70dd703c2eae
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzCaEucW/Rrmp:Pu6JmVxd2dunudRSp
TLSH
T1DCD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 aae092fe4c848bbfc0a841ec926f22bb8bb10f9fcc5f96606e37f5563e18c4eb
MD5 59b65dc6267f33c28fd37f98891a6b61
SHA1 c33d430dcf94641f040a7613e8d2787bbf340204
SHA512 6c3f0d126f75fbd7771c748b4f2cc9c1b8744dbe1a3f3b474ccc3dbe5871ab2f64e7b7ada8791f1670309adbe72c4be99675910918500ce53729371a74cad622
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xHCaEucW/Rrmp:NmifPbR/nudRSp
TLSH
T19FB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2b801bc984a302d0dae92171ef9afce6f94b1f9e065bfe76da9e4f44acb45b23
MD5 659159bbddace4fc6400862f8f8c2476
SHA1 817d33c3de14a46c7b21c57e38807fffe8efacbb
SHA512 d17d349982476f3b11c556585d3f1b70342c0692c68df20145b2c2723d80c4b8bd6d7e2b6182855ba02c141d08aeb54d1c9e7394b08bd8c45eeda47f43487cf5
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHq+CaEucW/Rrmp:r5dKTi61dnudRSp
TLSH
T149C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f605bcc3f7cc65e470bcfb15d2b8e5467f725042cfe01295b699bab98f5e6f04
MD5 c2f05a24cb1b3b8fdef95138278edb06
SHA1 fe7488c2b34171d4a49544ae756e8975d6ca209a
SHA512 1d3cc8308464d83baac30b052ca23df89b4fa1ad18906c84cb860bd05a0cdb23aecfc698b464b1c146bf55d5c3556dd65f32d0c6fd8d235c90aaf96f114c2f70
SSDEEP 49152:ghtSn8EApI0figngiDn0AP5wDCaEucW/Rrmp:xX2iyphDnudRSp
TLSH
T11295CF13F2D901E8D05ED174C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 baf0b709529bac45259cc47068181a8b7735a62d25e9a91935edf2785c1c719c
MD5 6bfcf0cba0ac4030437cb1c579857158
SHA1 ece728d9af2fa61d318c44ccb4b89bfb5e98c13a
SHA512 34cedebfd7109efff7a40b3070b5e4e01826c795c0d2088db6d2728ebe67f9f43512e338eb567a0be1848536f2e9d80f2852ea9c98abc2dee590a28535695e46
SSDEEP 12288:7fyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:7KCaEzwAyujOhcid/RrmpF
TLSH
T115752337DFCA87F2EA0567331CB61068EB953C97769A8A8FB66DF12D44B87D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 e5ed18847ac392c2ae7a456861fcc4edc339aaa44e79edf818ee4b38a79f3d95
MD5 8e41ae0764456d1b3dc094c858954a1b
SHA1 cc5567e503671d7ede24ca22e10ec0784c58f760
SHA512 18d2ae334445ed2857301192473fb50cbd30c70862c0a914934151f9e99872888c580899db507337420cc7de1da51c4b79dbcea8c8a3a712ca0485352af0ec5a
SSDEEP 12288:uMyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:uNCaEzwAyujOhcid/RrmpF
TLSH
T15D752337EF8A87F2E60567331CB21064DB553D9776AA8A8FB66DF12E44BC7D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 c41b656094aee1b4b44d68119a2e0cce4281c2be0a84cf7aa33b14f782a03172
MD5 4530ef27d93a5dfcfd7ca89864cd1e77
SHA1 f1930952de3beb3d02cd3edf3a618ca58f197b13
SHA512 646128c289212c8557432cb329ca4adab3774175eeaab9bd7bfdc5e6ee54eb6c5d6807fbbdea90db3564412fe8dc81ed7e6226244f3df787232af94333bccf6d
SSDEEP 12288:wayCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:w/CaEzwAyujOhcid/RrmpF
TLSH
T14E752337EF8A87F2EA4567331CB61064EB953C97769A8A8FB65DF12D44BCBC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 2df0512054ef00903a99486ddb9399541b3510e1ef15693dd98ebd839797a190
MD5 05f27eb4f3d2dcf05ec2f2089e2e7f01
SHA1 2428dcd37f847d3aefdb4550a307757fc8429b7f
SHA512 19cb5e16777f4bd1af9e3fa058ad4ea338a013b2d6434e4c4e6b304af07761e0386f510e11888d3dfe37711a24eb4f6daf6e56f2c6a5c4313a69577f41d33b33
SSDEEP 12288:sVFyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:zCaEzwAyujOhcid/RrmpF
TLSH
T1E4752327AF8A43F1E956E3324CB21024E7B63C966776CBCFB61C755E0CB47D05869620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 ab57c58ebc722e8e505b467dc21bb82878c96ce6427cbf5af114feca60332d4c
MD5 6161fd18b5ad0dd4db59cae9a24d86ef
SHA1 7f7281afbd2f3371930501b2fe8091695e2c57c8
SHA512 844280930db2d286972743163b9b9b1661f53f4ee0d24c8d7967ac185e62b7f6e930e1f83eaf3ff5eab68a1ac00b4a931ce22c3b7115739eb3303b9f1310b4a1
SSDEEP 12288:wtyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:wMCaEzwAyujOhcid/RrmpF
TLSH
T1CA752337EF8A87F2EA0567331CB61068EB953C97769A8A8FB65DF12D44BC7D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 a02ad348122674f14310d5d3da21e8559236a67e1b53e22f2bc6277cc1fde5fd
MD5 dcc0b98aef493455599e0652d0f2d586
SHA1 a29bad91d7a6643d0759d8edf606dfa9cce7e742
SHA512 dc8a75cc311a8dc8b0daff84030ab228b69a415a543d3bac9a9225424ad72e885537e37c2d4c560f7b2a429090f8f2e3b672531a3af2caf0fbfdd7048fc51b3b
SSDEEP 12288:/YyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:/pCaEzwAyujOhcid/RrmpF
TLSH
T136752337EF8A87F2E60667331CB21068DB553D9776AA868FB66DF12E44BC7D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 02d06f1e7167abcdf8c8149ad1bbfa99493d8af972b2a93108334f6dcccab48f
MD5 8c3144bab2f95ab95dde8630dfae9e48
SHA1 52640ddabd46d766add16c8f8751ea0df41a9e53
SHA512 6349c306bbd68a36b8f63da92d98a435117831a998df6185cc8ca72d499ab6d9fb6ad637acad32391f31efba8ff49881de34fe65d856ea650d27649670a6aab4
SSDEEP 12288:V0yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:V1CaEzwAyujOhcid/RrmpF
TLSH
T1D7752337DF8A87F2E60667331CB21068DB553D9776AACA8FB66DF16D40BC6D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 4d749c3baffb0a4817a9a88e9bd264a2729bc3e1b07b843522ea3c111d2a4620
MD5 351e7408bf6276ddda36a2d83ef18c52
SHA1 d03627e4e8f33ef792089d27572fdc2d46beebfa
SHA512 583f4c5a8e0cace6eb583651ae25f6112c4ef50add8e01f15192fd66a75a9ef2741d05971c06d5ca02eaf5ea3ba61e5d35f39cbc21ecaf75e7b592e13a2bb53b
SSDEEP 12288:uiZwbazzFEoS2cPvysyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:RZMyzFVSOtCaEzwAyujOhcid/RrmpF
TLSH
T1A38501A5B39019F4EC67823ECD654915D6B23C5A0BB0CA4F13B8366B5F733A01C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 d283d86445e68121fed5ffe16d5ac62b57f89958b3ded39d79c1355ec886fe18
MD5 1e49d026d8713f19b9bd2e889f015b5a
SHA1 70a77fc2dc7e39ac197a8c3dfb893275466d00af
SHA512 8b72a6c099ab6015c0a860f421b4096fdb72740031702804e9761648b74168c07145aa0b0101f5323ccfb22c1f3f69365e1663107e6c10b3cc04750d67b7a93e
SSDEEP 12288:IzyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:IOCaEzwAyujOhcid/RrmpF
TLSH
T14E752337EF8A87F2EA0567331CB61068DB593D97769ACA8FB65DF12D44BCAC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 25fd4012b8a0a64f84f75f121ff13bf0607d47e4706c739a0e033e5db53b07da
MD5 dea77ede7c6d1f3050aea228f7528edf
SHA1 eaae3952a70b0a60b66295f898d6d11f08f6d7c0
SHA512 9501d6d1a3a6a0c21c7cf30187e03f0f50a936933b8cf98976dde200f053b44f53a22d06ad84bd0ef5033fd1ba0455959f99eca414793e4ecbba89cbabb2bfe8
SSDEEP 12288:f3yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:fiCaEzwAyujOhcid/RrmpF
TLSH
T158752337EF8A87F2EA0667331CB21068DB593D97769A868FB66DF12D44BC7C0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 07d4fdedb99e742a497de9d363a6c190ff1bab90fb2d55f67b5d9f10ce03b07e
MD5 991ab6429d7a64bce8d594b77f3cd9e6
SHA1 7738e866ab021166bd764c2efe1c1d4c7d819642
SHA512 e7ba8c07db14bae83e36d226e8f6bc312549cf6b55c132792916a39ec53ca262aef53315ba36bb2a77f8d89d0da3f08d12f662d646e157ad68ec247bde09e379
SSDEEP 12288:iyPz5L8wyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:/zyhCaEzwAyujOhcid/RrmpF
TLSH
T1B6850117B79531F9E12693358CA21601F7B23C3217648B9F63A8667A1E377D09D3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 0ea4d2e40846a754c68a4ccfd9d7f8673ccb61632dba14ab5fdb5b1bd15393be
MD5 1cff854d61df568a129da51ee4dcec9c
SHA1 e6496807fd723fcae94324fc532066a442c9385b
SHA512 b0d140d327ea3ccb6a3fd71f568820a44f9c4ef594ce022f816f04c5c26d649772cd5036d46055cd1d6feaca772e477e12ddebae491a0ff2f1e423b4e3179285
SSDEEP 12288:xzyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:xOCaEzwAyujOhcid/RrmpF
TLSH
T10D752337EF8A87F2EA0567331CB61068DB593D97769A8ACFB65DF12D44BCAC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 157c7d6c584044af0e903a48da854156a56e4823e50b17c96e597cee865f3a65
MD5 39c072008e4ec68e11569c2864afeb42
SHA1 e09b1d04e342a6ed9aac7112d55a14394870772f
SHA512 9c06ffb986f89366688d3f936342276dff4e9d8615abb272e0c1d55228a5360834df741d1e8c87ee67668d248301fff35e5418152491e574d9624b515f62880f
SSDEEP 12288:IzyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:IOCaEzwAyujOhcid/RrmpF
TLSH
T1D2752337EF8A87F2EA0567331CB61068DB593D97769A8ACFB65DF12D44BC6C0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 c6ab7c7e101281f59205a3f695976eeac1725f771459d86108905319ccc13d72
MD5 7d14fec1baa24783208ac3f12b5e9ea3
SHA1 f94bebc3e0f6652abf4f35873ce485090e0ff0e1
SHA512 569a0f7eb040089ecbb3a646f708b1374a0bc6e8bd396a2efd67978867059669afb169b3fae227c22b8729f18414229013403e4082644a0feea6529bf028ea92
SSDEEP 12288:ByPz5L8wyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:QzyhCaEzwAyujOhcid/RrmpF
TLSH
T137850117B79531F9E12693358CA21601F7B23C3217648B9F63A8667A1E377D09D3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 d992d02e40fddf23f482227e5806bf543d0deb665743845c701ec90a085ea8f5
MD5 6142ced34e03af93d88892504dd7d3b5
SHA1 1129ee6cab44dc08ac987285f51ef93e50876542
SHA512 fa3805506f2ad572d1bc610f6db1b5c98cd7204f37103339ad06ed61ef8ba94b30b7c3f44d4886a9b16d4e339b9a2426b0acc3491780f0c849f500d164a43c40
SSDEEP 24576:DTnaLl3z0zDvCaEzwAyujOhcid/RrmpF:DTaLljwCaEucW/Rrmp
TLSH
T1358501A5B39058F8EC67823ECC664915D6B23C5A0770CA5F13B8366B5F373A01C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 560b082a93d043f2b224d65aae3675b92686941f4290abbb95765f0a19373a52
MD5 d0c357d80a57adc5f00b31f6465bab28
SHA1 78a793a9b9a46eea08142eb28fa0f6a4d4e5f939
SHA512 a44c37fb020b18df825b099c390f7f276974afcf950acceb0feee0cf21f16489434dc3a4eb0d0e7d0f65646362fd0d97aa8ae69742f815d4bf53f254a09c1654
SSDEEP 24576:v3sd9CHKy7GZ7CaEzwAyujOhcid/RrmpF:/sd9CHKya5CaEucW/Rrmp
TLSH
T1AC95CF90F3E415E4F0B79A358D764511DAB67C9A1B31CE8F03A8661A1E33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 b576f495ae6fdb1960c7b9b9194dee81fef0b514d5e3a4a332e8b41e1a75556e
MD5 3a7d34aa83878ce0f97194c5320319ff
SHA1 8832b2cd855af71580f5c0018a698eccdf0336d3
SHA512 0d9f02f60f3ee0a6cd5b561ffc0ba7e89f065e0015d845a007705cb679f6829cd3072fd8f68c5c66d2273896f6a99ddfaec4e845efed60e424c992533e2ef178
SSDEEP 12288:H6yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFuC:HfCaEzwAyujOhcid/RrmpF
TLSH
T1C1752337EF8A87F2EA0567331CB61064DB953C97769ACA8FB65DF12D44BCAD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 b12d8ccbc868d05f5053801569cbe8a0b4bab028e049a50a0343897ca91442cb
MD5 a79e46b7353b0fbb3430deae1f631c99
SHA1 7e0018f1bec81094b3e2196961a3eabea4479b85
SHA512 d8637fd4e366c2c39247ffa215b547ccccfacf95d34c0a0616acab62c8dafc0757f14a41f96ae8378d908a1d9835f352f5528dc4394095b58a95ea445f2a60ed
SSDEEP 12288:iQyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFuC:iBCaEzwAyujOhcid/RrmpF
TLSH
T1B8752337DF8A87F2E60967331CF61064DB553D9776AA8A8FB66DF12E44BCAC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 1c42a78be5582b6d3a8f879dbb652afbb6772b16bc2efc7974b972d22abed11d
MD5 dc7da665667e03f0e261adbcf9c9cc24
SHA1 5d0c6599889894ab7386eb6cecf5a933d7e2a241
SHA512 56ac9847433eab2c35cbdab209285287deb571ba8159d4392278bad58e1e6eea702941b35c088724dca210460a4203625302d85d668c8dccc9a92b556cb30adc
SSDEEP 12288:05yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:04CaEzwAyujOhcid/RrmpF
TLSH
T14B752337EF8A87F2EA0567331CB61068DB953D97769B8A8FB65DF12D44BCAC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 974adb0627c4d3a2bfc750a7bd6bdde9b704c5841e6c7dbf76956499cbd62688
MD5 c31318424c7ad30b07c90faf8b0b8b2c
SHA1 9bc58977f6ad652a23e284464815c850ff96c0bb
SHA512 b7f079b23cb204a15ef1794f4d89a67f9dd3c4b978b5fb57b448e8215b8378f698dd45b342dd831b5883e456f3a019f3259d61e372cf085ff56ca390936857d7
SSDEEP 12288:u4sfDyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:M+CaEzwAyujOhcid/RrmpF
TLSH
T1DE85F11AD28842E8D06E6236CB964640F7733C6693E1C3CB62D4F53E0F796D09DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 b444c2d6b7d47fd4a8df936ecae9dc45bc851e62f0be2df7a62bc63685442799
MD5 559d6272e18655f7213fc035779f4357
SHA1 d988eed3a153e0309f745f9f9c8805cbc471df6c
SHA512 8f519a87497b9d89bdb3e724e55a47e521731b2d5cff74ead26c6f1397d38f3cae7892f33fd63414348c1fc9a79be3b446f8882aedd0ad587068ffdc16705081
SSDEEP 12288:zNyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:zsCaEzwAyujOhcid/RrmpF
TLSH
T169752337DFCD9BB2F66A67321CB64034E71A3DA62B59C68FF10CB26D4478AC08C59125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7a923d1b81938421ed6000f0cc16a19488b6033d76f50f9f40b5029b69f93ffd
MD5 a62443ac7daf4d74a212776def9c5752
SHA1 1ac5241a5a0aa609575cfdaaf89cec1795785081
SHA512 fda6e96975860207c52678dac7ca8003fe418265a7c0b1fbef5851091585d7feae03623d86b9865ca8d32fb400c4593a71a940b48b37442ad0b8768871afc6c2
SSDEEP 49152:/a0h2GEkuAe73q3pp46zwwQmCaEucW/Rrmp:/a0hNYG4JwenudRSp
TLSH
T16E85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 f1d2e223fc5d9265db5a5e6581ba20dcba5286d8c507e891915cdd43c12233e0
MD5 d4226369558a7debc94a5668d439d48d
SHA1 e906c3d646412d7d93275f38df3b5e1166702686
SHA512 05660b8557195f12d219aabb77b17945dbcbe778045af5262a25329bcc00317865228be58a3c24c01d340da6295e3c8f2794572934fb731d3a9f7117a449aa40
SSDEEP 12288:LhbHjfXtyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:LhbHjPMCaEzwAyujOhcid/RrmpF
TLSH
T1C575127E5B9C21E5F572A33E49A2410AD7313C66172283DF2299A27E4F3BED04C39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 92f9ac6a0402a001e404024b3066a84490a1ac9ae84d4d8a6ba80b53d61e2073
MD5 c1a4d2449df1073e93869726d573f89c
SHA1 488fa73e5a591c2d1dd7fcbfe70b28eb01041787
SHA512 323bd7e3d1f45e5d96599e4baef13e47344168bbda5e224979ad4ade050c5d3415c1efa9c1b466f54319679eddae30edfb88ef321886ffb435dcc19817d2eca1
SSDEEP 24576:E3YgnJcRTk4yti+R5dBR/0CaEzwAyujOhcid/RrmpF:EIgnaTk46pBR/0CaEucW/Rrmp
TLSH
T15745B02EF3B910B9D8A6D236450143B5FB71782D1F209ACB0174C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 86d69c038f44e317a1e4081a45bd88e37e13bbaed4a63ae12b48b076173dc03b
MD5 4109d559089216fc91a0918cd7cd6178
SHA1 cede05794bff5d3bfaa4eba2d5d3aa869e5ca80b
SHA512 f9ed6e1e255178cac2e67c71cc2bd45c18ae0f10d4643894eec5912d2b31794b4a66735d378ab8e147b0a00778e8b2594bff370a209ee23f6bf496bf1171dcd0
SSDEEP 12288:IhyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:IACaEzwAyujOhcid/RrmpF
TLSH
T1AC752327DF8A9BB2EA4567330CB60028E7553D92276B8BCFB56DF16D40BCAD05879120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 ce34d26f34f3e6cd2cf0cc18db23917c7254e049db545b26cdb1f7cf7458b77f
MD5 7a2ac4c217935e3b3f1dcb52dba6febe
SHA1 39c5ecaf05bad39fb119a7d7925e3ca4dcde34f3
SHA512 1010e250f1c9f0ecf0a02883da9fe32470d8fdcf549ef4308ad8d84c44fca228868d773f42f47efa95b6fe09ec06c7cdc28fafe384822e1b3ccdac10a0cca977
SSDEEP 12288:ROb8A4LWOsvAYFTIyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:G8L3UT5CaEzwAyujOhcid/RrmpF
TLSH
T1DB950115FB9400F9E96B923D88B28516E372789D0364E7DF03AC8B691E637E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 e97eab9516fd19c9825c1c97d07e14746d3d8ce0b244ee56b4c298dbd76b8089
MD5 79d58d7dab165ee1f4ba3aac9b3513f5
SHA1 33f13d3f4b8437d929c55744cb18f2a392d26ba4
SHA512 4177a2bea979a070a74d0db7eae74f168c4bd5892e8f92eae26d1a783d6aa14748f69ecb27bcac14196d9c90361665c28021e5d8654e9aad8fba42a5f194d3c9
SSDEEP 12288:gpFt+O8yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:9OdCaEzwAyujOhcid/RrmpF
TLSH
T1C575022A3BDD11F5E576A23D49A2420CD3723C66172287DF029491BE4FB7FE46C3A621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fc2f947b5083e08451625e56c4b5aef227fe27a582d5305a27fea209f9a4d85e
MD5 9546b2bafe948fd1dfc07785691132bf
SHA1 86714e3d5996f53788be90947a15e83cbdb54c25
SHA512 2399144f951d2a0e2b39e8ff2c9ebe6a3089f1c6dc7d0570e03914339e995f7e63e40817d13fffebd961bd241d31ccdeb13041cf5b3009d37ebd75c97e13f010
SSDEEP 24576:57NM9YqZqmWMUkPjZM48Mv6bEhscCaEzwAyujOhcid/RrmpF:57cBWMpPjN8DbEh3CaEucW/Rrmp
TLSH
T112659E2E6BEC81E5D577D13DC9A28205F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e6bbd901cb4ba4bc2cd462102131e4bc3d3a202fc190eb6b447bddd39e947119
MD5 f83dc11a838179fc4c4aa6a986029080
SHA1 4b5858a72efa67a1a36f4eb8d33c7c00bca929cf
SHA512 4c3417a9e49c95571c4d8174a9d91d84f52abf17758f73604bf96b628e2405f78211a970fe7d7f57c26d98d93a90f15c495c52c9698fb5f19585bf269a30213a
SSDEEP 24576:VW6BApg2YuyuNDYTabvcdvNYf8km1iCaEzwAyujOhcid/RrmpF:VF2YuHNETovAvNYf8km8CaEucW/Rrmp
TLSH
T135858E2A67ED80A4E0BBD27D45B79246FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 89efa13cfdcc97c67c188a85203a5d5dc22a5a2dc1b5f5486c2d19992ff81d52
MD5 87428c9b2e7115847ecce355bfd7ab3f
SHA1 ebf961997f4a028996d4d714a05180053af0550b
SHA512 32079a2ba072b6e6c5e2ddf4632847a4d80283555b681924e47e07310556bb653016c96d6f0b7f8fb15cc2fb93da237168c8187894e2327488bf69b576bc9d6d
SSDEEP 24576:8AFs06+Omlf3NXEbTohCaEzwAyujOhcid/RrmpF:RFs060lVXuGCaEucW/Rrmp
TLSH
T1DB65AF2F66EC00D5D07ED27E8997C91AF6B1746307255ACB0160863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 babf29f3538a3a6acbd135d2efa150b266054f0ae26012e33028abd09e50ecb4
MD5 3b6bdbcb5c9d11c9c27819fb9bccac1f
SHA1 13d47f49dd14614ae0e68609c0e568e11928a1ae
SHA512 8a87eb890dbde39c94bead9502871a47b79d0472386f34bd23f4db02a2b660537f979559af7571d72dc751b9fec8a29187ec83bc3f4a4621d4a82565db7e0fee
SSDEEP 12288:SCJnJ5D3VkrDzx9yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:TJnJ5D3WXGCaEzwAyujOhcid/RrmpF
TLSH
T1EC95D02DD29810F8D4B7C374819A1755FF72386D2B226ACB28B8D5353F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d3c18955b5939f70d1f224be8bd584dcc607ebda16db67f52483298370f53c14
MD5 1e664a08476281ad656b6014f7842e39
SHA1 69d70df80883ac49a3e617b608a902e3d2e3e711
SHA512 bfa05f278291cd8b252c0d681e47742d36b58daef6ad2af1bc080b57c0534764ec53e2e4cdd45f7f7e9be15bb9c6dc959b3b5a682d4b4f420284da7019f901b9
SSDEEP 49152:Ig06DIKdwc+eQnSt65aVoCaEucW/Rrmp:JxnudRSp
TLSH
T168956C16BBEA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 e762f238594172f27597cc3419d57b8a2949e1d515d3de10c17d8d21235019ec
MD5 a9725900384ee2b6b9bb7c0afb527a12
SHA1 13f13153b6228d8eb1579f8ef72b7f86b7fffaa9
SHA512 e741f47cebfa20506241bd02fecdb25b8c4e10519b1e64424342c254c5a79fe5027c47a681bdd9ff312ee258e7a89c5e02db9249ebdd1dde9a7d8260d9635542
SSDEEP 12288:KEP3RW8yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:pWdCaEzwAyujOhcid/RrmpF
TLSH
T1C375123E6B8D71F5E12AA23E48A14104D3B2B471275257DF62E9E23E4E77AE01D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.7MB
SHA256 c0aa92c613b7d35173a930a6c001637ab8d4c38d0acebe64755cfedb0338a23b
MD5 03b4f792870bb9a8d9f227eab6d540ae
SHA1 74fd6294a71c4c0d8f142b3e87b6e00d3d1df5f4
SHA512 a87a72c2cd933550cbff2c4a1e1aa7021fec8ac3dac0a6136e1d2adafbc9482bf039fb7aa8df0be50818ec8092d1e72a5961e7606492fa2e169b3303a8c7fc0f
SSDEEP 12288:DjkyiyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:DIynCaEzwAyujOhcid/RrmpF
TLSH
T155851216A7C892E4EAA617394DB341A4DB753C212F2187CFB094F63E5E7ABD0AC34711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 f9ba2f00323803f5e715f714c71dd43700b682bfcb2564d3d7236582b89529e5
MD5 64f81066315806e25e92c4abe8a79087
SHA1 d4371c213dfcde746523efdc9d08a4cf1efaecc0
SHA512 001a1f0cc01c2401ef0542c858264be1e8926ba3c0d257d2b18d16f522e83a374bd805b6de17bd872b3dbdc3662653da985cab5af5b29305d51aae58d96f7ba7
SSDEEP 12288:1jsyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:1tCaEzwAyujOhcid/RrmpF
TLSH
T1C375232FDB8AA7F5EA0667330CB60124D7613C66276A8ADF70ECF17D84B87C0587A510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d0b146f9290af75f4b858b6de18cc762bd263da7a51c647695c3945755fc0682
MD5 b4682058e29997d7e72726a733dcd9ee
SHA1 ddf227682d9bd0143479c55270e23cc48456aaf8
SHA512 32af6f09e04b6d36ea48cd98d81ac6b0832fde3c694097a485984dea2be5167fb4b37d59b00bb09c8b51d5c475dac2d99a099becef090f3b8c4bfae938725d6a
SSDEEP 24576:1Q9MxZKdcz9dw3ECaEzwAyujOhcid/RrmpF:1VKZECaEucW/Rrmp
TLSH
T185558C2DABE9059AE177D23594B250C3A673B4311B35C6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 33a3fd1b5ad946aa303c8e00fbdb877779733d893bcc9f89f3dc0bce91ec8389
MD5 525c004a6a9d9f641d4b24d6d1539d13
SHA1 7131519706a290cd12f87f12e6a47c5bfc606e13
SHA512 33292fbc544fa2d612bae13ac69af31c88c8af585842c538f3ff5a0365c58c31ec93e7570631058b8c23dea0f551dddd4ed965b5a4ff9eb6fa6196f2f0f0c887
SSDEEP 12288:ayoKo24Rple9pWyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:ayoc+ApLCaEzwAyujOhcid/RrmpF
TLSH
T13A85F11FBBAE40E2E166823C89858344E77374701B6257CB6595C33D8E77AE8BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 09301f0037bcff0dac1213e2423a1bae5e80864d9832d3ce9d5f02483e503630
MD5 1729e0442af934e801c9bd3bc7393ce6
SHA1 7da014b4dcbf6f603f44b7ba76ccf1f068cba217
SHA512 166e05d973acd8ffc25105ac8ebaa748baeafb66ce493a76c6101bd72f98aa08a965f9439fc19bf1bff65c37d2d09e2889ebd0c203a855a7140576af02167231
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKLCaEucW/Rrmp:U0zuNIInudRSp
TLSH
T12FA57B3DA2EC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fecd9d9d9acaf426d9bec10a515167718c29afcc8f2437c45529138b1804d7ad
MD5 52caf6c38ef74187ba1928d23bf97bd3
SHA1 9ba8ef90a97f5cceba1df36ac7cfd5edbbeb50e2
SHA512 9dddea0afc4ee5ec4767e482d3d50210769867b5a2e2ecb35ee21ddc86192c68aecda4dfff25f942119a3e818b7a702cd450473e61fd19d5dc959b8fb0b8dce4
SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYtjMqbdCaEzwAyujOhcid/RrmpF:YTDxR+N5YzTfjMmCaEucW/Rrmp
TLSH
T11355B02EA7F915E5D17E86799A238512FB727821033193CF42A0C17E0E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/312-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/312-25-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/312-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/652-423-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/652-307-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/652-314-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/652-308-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/984-417-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/984-288-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/984-342-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1580-326-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1580-425-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1700-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1700-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1700-321-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1700-323-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1756-416-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1756-292-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2080-257-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/2080-325-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/2264-424-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2264-318-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2284-95-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/2284-93-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2284-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2284-80-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/2284-78-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2484-427-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2484-335-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2608-421-0x000000000C980000-0x000000000C988000-memory.dmp

Download

memory/2608-429-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2608-414-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2608-398-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2608-382-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2608-343-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2756-245-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2756-44-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2756-42-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2756-36-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3152-122-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/3152-13-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/3156-330-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3156-426-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3216-33-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3216-30-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3216-0-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3216-9-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3216-1-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3740-268-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3740-262-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3740-261-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/3740-329-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/3956-247-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3956-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3956-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3956-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4140-420-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4140-295-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4140-296-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4140-302-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4224-285-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4224-338-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4248-50-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4248-70-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4248-67-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4248-56-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4248-29-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4504-90-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4504-248-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/4504-92-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/4504-84-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4728-333-0x0000000000400000-0x000000000058C000-memory.dmp

Download

memory/4728-275-0x0000000000400000-0x000000000058C000-memory.dmp

Download

memory/4728-281-0x0000000000650000-0x00000000006B6000-memory.dmp

Download

memory/4728-276-0x0000000000650000-0x00000000006B6000-memory.dmp

Download

memory/4896-443-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-467-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-447-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-446-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-445-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-444-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-448-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-442-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-441-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-440-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-439-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-438-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-437-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-436-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-435-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-434-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-433-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-432-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-468-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-449-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-466-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-465-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-464-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-463-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-462-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-461-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-460-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-459-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-458-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-457-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-456-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-455-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-454-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-453-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-452-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-451-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/4896-450-0x000001C4D7C50000-0x000001C4D7C60000-memory.dmp

Download

memory/5116-428-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/5116-340-0x0000000140000000-0x00000001401BB000-memory.dmp

Download