8c13b0926efbcadd69b197e052c8b31fb00d47e709452382abd96ffc4e87ed85

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 3.6MB
Sample260910-wf55sswtbz
SHA256 8c13b0926efbcadd69b197e052c8b31fb00d47e709452382abd96ffc4e87ed85
MD5 3dcbfa1d72c2c6b488dcd72deb83c310
SHA1 579c36c7761732488005d3bab9fd5fbdfc0241c2
SHA512 fa47ecfbce5c76d7d4364a9b651205e195448fcfa74453c3f14829634ccd24b17ff7ffa1465e36c5de5c67da36e83d76d4d5fe3fe2f83082be357744df41cf1d
SSDEEP 49152:qeJ2parrqFULC/en6QpxfaF21FtTi3sZZRE7nee3g1tQDmg27RnWGj:4PyyGZY4m0e7swD527BWG
TLSH
T189065B23B19B90D8C01DD074CF564BB2A5617CA9C7A5A3DF06D47E213B36AD07BBA318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3420	alg.exe
2496	DiagnosticsHub.StandardCollector.Service.exe
2272	fxssvc.exe
1828	elevation_service.exe
1228	elevation_service.exe
3604	maintenanceservice.exe
176	OSE.EXE
1712	msdtc.exe
1604	PerceptionSimulationService.exe
60	perfhost.exe
5092	locator.exe
4936	SensorDataService.exe
312	snmptrap.exe
2188	spectrum.exe
3380	ssh-agent.exe
4800	TieringEngineService.exe
1748	AgentService.exe
1624	vds.exe
2280	vssvc.exe
2364	wbengine.exe
3000	WmiApSrv.exe
2688	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f6c0ceaf79c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a78f8724d41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000290d0a724d41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e652d2724d41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a39532724d41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005306e724d41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a78f8724d41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b4905724d41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f53230724d41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2496	DiagnosticsHub.StandardCollector.Service.exe
2496	DiagnosticsHub.StandardCollector.Service.exe
2496	DiagnosticsHub.StandardCollector.Service.exe
2496	DiagnosticsHub.StandardCollector.Service.exe
2496	DiagnosticsHub.StandardCollector.Service.exe
2496	DiagnosticsHub.StandardCollector.Service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe
1828	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2772	2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	2272	fxssvc.exe
Token: SeDebugPrivilege	2496	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1828	elevation_service.exe
Token: SeRestorePrivilege	4800	TieringEngineService.exe
Token: SeManageVolumePrivilege	4800	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1748	AgentService.exe
Token: SeBackupPrivilege	2280	vssvc.exe
Token: SeRestorePrivilege	2280	vssvc.exe
Token: SeAuditPrivilege	2280	vssvc.exe
Token: SeBackupPrivilege	2364	wbengine.exe
Token: SeRestorePrivilege	2364	wbengine.exe
Token: SeSecurityPrivilege	2364	wbengine.exe
Token: 33	2688	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeDebugPrivilege	1828	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3768	2688	SearchIndexer.exe	116
PID 2688 wrote to memory of 4576	2688	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_3dcbfa1d72c2c6b488dcd72deb83c310_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5104

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1228

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3604

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:176

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1712

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1604

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:60

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4936

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:312

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2188

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3936

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3000

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3768
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4327808da803b8018912fe6531458fee9f0fbf996ff489e80c540b65daaa1172
MD5 4a9c5f3432f37eeeaf8a11225852e048
SHA1 5e0c71fc8883798c1b4240da8878ad15db6e317b
SHA512 1b53baefebaf40f7b7d19f25434d608a6dd772e3f0fbd58cf4c1325138104ce109c457eb9aa88482615914485b03a75a06df927df729a1f6dcfa575dc91296c9
SSDEEP 49152:db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXDmg27RnWGj:j3q6HjBcD527BWG
TLSH
T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 018f847909be913cc1350f194df97ba6b0cd53f80c636a361746fce149c5164f
MD5 2970f3a92613098fa0c4a0129a43ec0e
SHA1 8600cace902a65489658a08cf74d9dcf45023d0f
SHA512 f48c188da2a13197dac537b6482b1c44f9c6944724a7b0c2ed1abe9e83f8168cdb9d3e8c9b5fba970cdbcb56d042fe01ba899f2075402ddd0c669a1ca26734e8
SSDEEP 24576:iXYfDtczA8sqjnhMgeiCl7G0nehbGZpbD:ptcJDmg27RnWGj
TLSH
T1BF050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 63678bceb874b1824a947a6d520992ba612e6c72f65649486c7be6f289ff60f8
MD5 6980611a03a1874b8d729fc7c30912ea
SHA1 238f21603dd1ca40d6c59f193d38c7423b624035
SHA512 d1bc0ca5b152bc4219b2a02e19138e4b886ab8f793844fc47584d5e11f5e4be92b53882b26a485d5b4992c0876f1cd1b2e0fcb886b0eed509ce40d09fb76d30a
SSDEEP 24576:k0Le5ji0hmxirMrsqjnhMgeiCl7G0nehbGZpbD:kPji0AceDmg27RnWGj
TLSH
T1EE359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b36dd784c8bc417b77f9ae46947fb242f13be3d70677dfecac189fdcd94ca56b
MD5 dab8af1ae65af6f88652e2b95dc1cce8
SHA1 9819167d89c64bf2084018a4bcdb05076430124c
SHA512 1ed7ca8bea6b6d8d905511ef3cab933b5a35a6ab6008eb06125857879f02c9e58b379266c2ce53465269845490fec5abd9ef90b1fa072eaf5c68e24c3825466c
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyulsqjnhMgeiCl7G0nehbGZpbD:R/ezSC6vUzPvxHjy6Dmg27RnWGj
TLSH
T18D755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 319134a60feee632c1255ca59db5ea1da52aa504961a85596dc355cbbb599993
MD5 e8be47c310d90214a192f540f697b10b
SHA1 e91216a80ce2edef5f97e35db371ed84f84c8085
SHA512 0927d06beae0c559a08a7934f83e612b472bf8e00514e959d8988609f16929a7f37d42df045b8eb8c2d3dca935af9e31c926a5cc7617fb28c6afe541a9f681c8
SSDEEP 24576:bVbqPb88hv/l+6wsqjnhMgeiCl7G0nehbGZpbD:bVO88hXl+bDmg27RnWGj
TLSH
T1A9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8212a41e0dcb5045b6360411433625fed15ce335e01edac7e4ad4bc587d84c0c
MD5 7dabebbf106daaddfc2fee0df3316fbf
SHA1 5801323fdce6b34bebb300bcf4aa6a2414c35dfd
SHA512 11313b48f29f9e8de1742e4de4cb76ba00a88570eb921310ccde67f878f9a704fa87774c1f04e6ca34cbe7b50ff40d1bc92d9d3eb01e89e826e20f4f77f29e1f
SSDEEP 12288:iRvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iRvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T101C423BE824C11DAEA7608B5C3E9F15DAC173E5698200C436AA37DFDE6F5464CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 18a052b43bebe4604faede94dd3d5d08e141d2b22b497781f72af094806296ed
MD5 103c184c4606536acdab9ca35f1b937a
SHA1 ba5358121db3f2ed82f8293648d2e7838e409a76
SHA512 ff4c95eecc630ff4e6d3d131947a8b07ae2c9ba728165bdcbadc018bd1db6c624fa0b04054648eaf8a4d20e1b919895482f0d9dffe3e4d5507e8270843402eef
SSDEEP 12288:weBNUbTVO86UIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:wJIUIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15305CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a05f892854faf3e42d62486bdb249bc677b9426f8cf115d43b58ab3a941ef323
MD5 05e198f5e1f3c61653e664d412c265cb
SHA1 1b63866149b52cc2d3780764aeb1e3585d46cb4a
SHA512 6e239ee5d364fbbd660d7c874964c5dd2f3a4c109489671f687641c30851cb982dbb613e308a6bc9156f8ed21a003a99e4e6ace874030ed1b0465f747b87c9d2
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH3:PQvGAdlCEL8c/yRNw5CpD527BWG
TLSH
T1C6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 04600f14d466c69066de1720c3541efc03ba1273c1cdcaced706d02ca4c53e92
MD5 ac03e72a11c497caa0acb7c857a8d1b5
SHA1 09a76c2c8a87c5c86b13f28de4f9ebd19a111113
SHA512 651debb823019a6afe9cf774d0c7ff8fd64df4a4ef74998f7e29ec4b2287cb306280133b327d51b9e71aa3130a79f721d61dee0414afbd72d68056d2df2ddad3
SSDEEP 12288:TAwSfxL/2Dc34DLLmt0LDQewsAjaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:MdewsAjasqjnhMgeiCl7G0nehbGZpbD
TLSH
T11215E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89E9E99702D12776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 85f3227a5078c3c7b9d31699f4e81081e4219d55297e4f3564835045ca781f8f
MD5 10e8ef0de31e034e39c2493aa6186476
SHA1 95b7c4267cd1fcdf86cda01c2b4bec2d1895808d
SHA512 72c8a9ee84ec0d0807c43976ddd9aa83407a64bace28f8b93445b448970a7c8051a262a2eed99ce47f252fef941dddd01fdfbf84dce57a9331ae21ecb6a655c6
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmVQBWG:YUEtQevvqc2W1cpV2EI325B
TLSH
T186474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3bb322ad94fc2dc8646ae37da75777970b7edfd7b4bcb0873d0dac6d3bcf9ee8
MD5 e22bb06d7704f4ef3e8526e022a9b793
SHA1 b0c5e450440ebac17dcb9005dba56b4822bdf0fc
SHA512 738549131210410a5577a7aec32c196cb016eba460918e3010bdbeb94bdb8bbd53f558a90b8c00ec22a6c69f4930b2948174b6f8c2a0978611d89cecaae26e87
SSDEEP 49152:eCbRquA/m2yL5zQfFiV+XenmE3/zODmg27RnWGj:ToqtVjnmVD527BWG
TLSH
T153D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0262b9873c150194eb27a48e518f467b68abc698637f18b109501e9c879c958c
MD5 8b317dedccb057d5b68a4b658db5b3ef
SHA1 d50d13bd270e86cb864401aef049950b3d6e8937
SHA512 f45cf06b515dbd7545b13f7fcf36eb05ec32ed3af973b0bd3ebddba71379cc23741470faac91ebc5626de6ea1f8eb7d310746536e1626cf82c76ee633fde20a3
SSDEEP 24576:0AhGLJIFoiwtA5l7S53hsqjnhMgeiCl7G0nehbGZpbD:0AMyFoiq5lDmg27RnWGj
TLSH
T1F1359D81E7F951D4F5B3AAB899B69171E977BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3284931cd6c8d36fb13fe3bc87f410b7075e24865bea4bbafc53acc0361a5fee
MD5 a24146200826527944feb748e87fcfa1
SHA1 7e490a478e9505ec5697287b878a7f5578693fdf
SHA512 3ed9b9aad787677b2ca99ab5d34934395da77df7192d631b2c14d21ba95df2ebf3b4fe5a54aa2f0af6101998f7ab1539377156d2667c5fc8c6cd0b459d1a6dd8
SSDEEP 12288:gmw5HEjsChNVBFgl0WDm+CFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:9wuoOWWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E05F14A72A81CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33260AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 092873bbae9796fa1086996b5166f0541982275b44973973108a8a269f534272
MD5 59e87780c7a45e7597963d675eeafe8b
SHA1 b39ea49188a0bf4236c99664c7abd30243f9017d
SHA512 05ccb9f5e4b2f4893698f4fea851743bde146a65571af5a614f242fb4ec160c9365b4a61d279c38eb451a35a1ceac43058d614574c4e77004cc82644f6b5bc72
SSDEEP 12288:BBZ1IyqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vZujsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CDE412AE239820FAE563417CC6E5D609E7333C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 51d1385d06aeaeb9f3820614d121f4e9d08500a162e2440b5251b6426f87bb33
MD5 38f69a7a271fc2ca52e8f9a8a3cbdfe0
SHA1 fe76c70d7458f007f53d0dc4f83391bc2be9aa7e
SHA512 01249207c4c07a469832b79ea0ceb4c444f856d05f0181106124156042d676f007f2bbbf406209b58f4f5edac6363a24c3bdc002183bc2bc67992b7523210ac5
SSDEEP 98304:kQRQyi36YOcPQLvw2gAf+PN3QD527BWG:rQyiKayX+PNAVQBWG
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e8a8b3580f5c1ea09a6329bc568714de5f24ad21ff152d36b8bef03b710bf19b
MD5 4987657698025dbe63988ff187f925f3
SHA1 3298f546a224a663b86408e834f5f9189ec76fc1
SHA512 1357bf932ccbf8a1f404402d17325a1b97970627353cb7d56dc4f3f0802f3c23435e52ae8e26580b97e78a4159bc330701cdf313a4e4ae7bda91687ca979136b
SSDEEP 98304:vQRQyi36YOcPQLvw2gAf+PN3QD527BWG:eQyiKayX+PNAVQBWG
TLSH
T11C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 86e85c45cc18cb0e39e76648c884f98369e5dc26b2baeb996fc04222dcdb369e
MD5 a4f577cf98b6358bc349cf1072e3c5ea
SHA1 ade7f11cddfdc5ab127d311c7f4f94e9730379df
SHA512 b3e6d1f2fbf6f60c7b789c0cbbd8aea42722aada8013eced9e751981df25e2589aa7d12351bccecace2406a8c575c586c88baa88ce747a3fa3108b461cee30fa
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0TsqjnhMgeiCl7Ge:w68Qg55nhheWu7PNU3/eDmg27RnWGj
TLSH
T1B2B55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3a141618d3fb595b4ddd187c126b215641be19d9c5d733b1cf04b052a8a7bad9
MD5 4b35fbc6503320d6d26efa9c91e2e70c
SHA1 f8a78f6ac126e381e4946e8aa1e7b3845c45a2d2
SHA512 7309f006f93b6412dca9504e225ebb23c45fed192272a47fe7a99ddf270fdcb07eae0fd48ac6ef4c92af741097ad54523b8045a62ea41cdf716472c329c3d7c2
SSDEEP 98304:Ky5112gYy5azzVvL69nLKnhZTD527BWG:zLIHmWhtVQBWG
TLSH
T1F7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 26d0f83ea19d0f520cfbba649594dd92e3b81e9eec46b04a64d9fddb1b5677e6
MD5 31566435b561d5f28446d97189e31171
SHA1 6aea296f6e07ec56c7cac9c7ed0835d6a9a06b1f
SHA512 17c20dcae403616152a8e006fa2d796b24cb3675e4207aec5438ff040faf4792518b14809e4d3887cfc8484b1ad96118e406727c2f8c4d4124c63de5e2a212b1
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glbDmg27RnWGj:pu6JmVxd2dbD527BWG
TLSH
T195D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d90ddf7caf133ae4ff5e52ce1c57919a1c81de15bb6127cf3315c1a15d136448
MD5 1a2bc852f6eb77ebc39e9f73761a20a2
SHA1 b84ff9fe2ee716f5ebae1f70f830b89c3ff9f929
SHA512 6a4fb2c8050834f484c13198dff5d511bf979dfc0ee1804957b8ee3671aca90be9a80f7e12eb6d224ed9d6c75c2299638b737aacf8c8e5bc627935d3e23c9fff
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xUDmg27RnWGj:FmifPbRVD527BWG
TLSH
T18DB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d999ad32bf2ac728c0f2beb9ae38c6e1d9df189943f2a8ff3104e66afcd3c489
MD5 b45596f9de87da544cb6b6f4620d59da
SHA1 8b89b76179898c405f1abf64a9821a7d04a8a93c
SHA512 a5ba1f5be9b1656e9da9706eabfb2a7740c718af56ad850eac72022c9d4642347329232a4a070fa5e0b2208a9a2f09759fc27e9f2661328d77d63a1269803f10
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqnDmg27RnWGj:e5dKTi61nD527BWG
TLSH
T110C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1aa56c3da796d7afe304025862ee561636b69b3765557b1ce6f144b69275088d
MD5 7c46566fe1c1de762c240df0df5bb659
SHA1 4a7c2871943badcd8cbd45cb3c4e100284a44d29
SHA512 4a1d20048244a261b5acb42bf8f8c92ea9470b2ded03506fccdf3f1c96e072f996e5be5d8a006259a4a872da4c3dbbfac777a1263c7a8101f894a2a7746a7756
SSDEEP 49152:chtSn8EApI0figngiDn0AP5woDmg27RnWGj:dX2iyphBD527BWG
TLSH
T13B95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 45506acfbdc5a489ec025215e84ea345f112cd051063556fa7b23b11be6424bb
MD5 85e464b48083311a10d2ca0b8fc31c32
SHA1 41b052752271af975c58f27f9a65ce1f1908f4d9
SHA512 ac16ad877dd0f8653ce6ef941cd562ee56f11a48f33203f446dacde8fd965c0f36fd09b0a4dfa980fab4e6f77a6be9c0acebf421b20f44fe3053a0aa3fed19f7
SSDEEP 12288:sHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T181C423BE914C11CBE92244B5C3E5F15DE8173E57E92004837A6B78BEF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6cae515c20a976b03dca62e659e6747bec77427180d4f1aa63dc0b811f10106d
MD5 fdd5886f19d068f6d9d129b86afbff4d
SHA1 9e87cdaf0033d2ef953a522038d10650f65cb03c
SHA512 799a20b8947ca1f6fc067c52fde5c357a9ccb5edb495d0d32d047a4a431f100cbc6b24017f5d8c8814089f03850969bac1647d84b57d9403e86aa1b547f34f4a
SSDEEP 12288:YeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YesqjnhMgeiCl7G0nehbGZpbD
TLSH
T165C423BE914C01CBE92244B5C3E5F15DEC173E57E92004837A6B78BAF7F28684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 73c166c54de28144355aa54e354e0d30dd09a1a7e96e2584052d13b8ae84881f
MD5 8af4a4ddf86f3d3a3112ceb64e63de52
SHA1 6d4ac7983f349d5e2fa32ad474a636679722307f
SHA512 093aabd35e2e521343a6f6f447ce39bb965007015aa011d06ff78df9493f915a11a8f48464773427f72d38a641c04abb4d60718833bbf209f49d2501a7fb98b3
SSDEEP 12288:ogXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ogsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14FC423BE915C01CBE92244B5C3E5E15DEC173E57E9200483BA9B78BDF7F28684B39462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 38e3e77bb6cad1727eeeb3f84f3a9bc00c1540d2a4944b626a71d865f2135849
MD5 0557b2ca1024a9debc8cdad99e4671dc
SHA1 80512c0ea7dd10d914a1b6f327f7f3deeb41efa6
SHA512 39c2bca7d3b701c14854a2481f4a04c83752fcb07947c6884118642c02040f7ed24152ef15fef1778000a76720ee25b764e30125b20d361987afdec02a76cea9
SSDEEP 12288:KVBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:usqjnhMgeiCl7G0nehbGZpbD
TLSH
T188D4236E535C01C6E83285B5C2E5E11DE8337D56EB3005DB6B532CAD9FF26948F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7e866aa33b2b0f2a9f88944cb3aef0317fdf0ad36e00bc2d8ae3deb9c47be0fa
MD5 bde34beb68278276d2f48cf47820a103
SHA1 b4c027add7213ab625391666087c8f89a9b8164a
SHA512 2e6742fd2bcc7b95de4c997353bdac6b2b7c62d34aefdc15411d947df33daf4836d5b2ab4e752bbb2393b64a00d0d1ef5387ff67065f729d8f4cf157f9550d4a
SSDEEP 12288:eJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A2C423BE914C01CBE92644B5C3E5E15DEC173E57E9200483BA9B78BDF7F28684B39462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6afb21f65b48f391a57f65f9be609a67e0bf16e7bcaa89f76a455ac7e1f3012f
MD5 6936c6da1b091ee2d4bc431eae2a7065
SHA1 35977a46c71795719f935e860e80fa960cccb411
SHA512 ff1e88a8aefc4130ffa72e8491c7ae50e27e15ce562b32398ce44371a65baf2c962b2340f88d5a0e7f9357f4572c97e67baa2fbeca5277eceecbdcbd04a1dab6
SSDEEP 12288:wyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wysqjnhMgeiCl7G0nehbGZpbD
TLSH
T100C423BE914C01CBE92644B5C3E5E15DEC173E57E92004837A6B78BAF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 77487c0566407bb2a4435f352e6fd91229dcc44080db41200c411e963e8709cc
MD5 377cd6a587ec216e3fe3a302d6d87092
SHA1 708d3f8b4302c54d658199d3696402eb471f5677
SHA512 6bceed4959b8fb4a8bf5d4241dcc4ca85c0f3b6b55310643356cec95a8630554c92a7d16d89588f0ff1cea1d1ffd78abfc89a7bd05927627ac2634027d34bb85
SSDEEP 12288:sGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14FC423BE914C01CBE92644B5C3E5E15DEC173E57E9200483BA6BB8F9F7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e47c14551dbd971bd9a966a7e8b9320132776d9dcfa0196a7622f69b400d2613
MD5 c1f4496b8a1aa465ba9aa2c7969e34df
SHA1 f0d89a2f49bf445c774c31c7f544d357fcec2315
SHA512 6350ce23ed357919c76df791073b10d815e1ba2a6424e2fa75a0407dcf0f888015e12fdba38414464773d794702a19ac46fbb0356051c0415fc1960e449c64c1
SSDEEP 24576:AZMSzFVSO+sqjnhMgeiCl7G0nehbGZpbD:AZMSzfGDmg27RnWGj
TLSH
T1B80501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 1016e845af345e43f573175f2504e16a026523240cea40b8f4dc3ed7be82144c
MD5 2d797329f2d6c68e611c973c1d6c53f4
SHA1 48ff70f9524f6bd967c90773462cbf3d11c89815
SHA512 54df2d24fa4bd162132c39041a518c182a589ee1affd4f1db8b98f15b30804f78478b5ceb25f773c407b9650fe757b7057d40cfdc81497dec090862688a1daa4
SSDEEP 12288:8zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T173C423BE915C11CAE92604B5C3E5E15DEC173E5BF9200483BA5B78BDF7F28684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c72864075df91d5e563a379653c357d8fd25dd210968f2fc1e4ad9710cd14330
MD5 d52cb6227e768dbe547dc909d60076cf
SHA1 26b81fb871f16ef40b98acd55c895fcdf0657e66
SHA512 4a38ae1c6445b4fd18ce5ffad3981ca26b68f2386f5299403500a0fe422ef77e6e6df4c2ab465c49f4ba715f88a5cab80f76865b77b7c9117b118ffc86dc442c
SSDEEP 12288:z/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CCC423BE914C01CAE92244B5C3E5E15DEC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3547f0c54df85b63834b6e4358f42e9acb830dcd8401408dc48d8e7ecf1fdba0
MD5 c3295d02c4d153e72fdbd267626be382
SHA1 df32b69b16ca569e095fbd3c340c61604b258052
SHA512 e773756af6cd3655f6aa57d0b14f18830cddbdce992204f3b3e83875a919e185e4d086be059b67a0e43a63d646ba316f7b4873974341cf7815619e9353534e64
SSDEEP 12288:pyPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T129F4025B73A430F9D1378138C5A29A05F7337C365B204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 46289caa30f1852d2f7879bcecad15ce5b2284868258e4067234dc068f2120ac
MD5 415fb82dab21f3018092017fd2e434ad
SHA1 280a52e61068cdef2a2fb791d573c58baf299487
SHA512 cbf8fa2824095f767a8fad9b4fe4631db3ee56d9565c8fc924f746d79543edb868ac2149ac1cfcf6f6895716144fc628bdf48b321dd7751acf8ebe6040c94616
SSDEEP 12288:yzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D7C423BE914C11CAE92604B5C3E5E15DEC173E5BF9200483BA5B78BDF7F28684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 588b40fac281799318191973d01506b65a05691a6b50f9bedd0fe4e893db9509
MD5 63f3f41d23893e589eaa394bc75cd95e
SHA1 ebec6cfff66d9ef0c45366b94fd1ec5a6dec8c35
SHA512 46f7999de62e000abfbb2ccb0e444a115fa5be82322a110761b9799c4df9f8b44ab5a6deb32955b2bbba6e5a0757f2419563b4c02944a4527aa5d93b133a8f9b
SSDEEP 12288:+zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19BC423BE915C01CAE92604B5C3E5E15DEC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 d15c62f81d14e65c3996cd501911930a1e89637c2a1d69fec288ccfaf4ddb6fb
MD5 cea1bc219344da55c8f291be1c6b1a6f
SHA1 f8aa7cabc71be957d83b434d0fe0ec78c4cdb4fc
SHA512 90f736488b870ad9e906fc3f34924471c6679ea5bb8d44eb0aae081245bd4f49d9ae2bf9c0648988eb21d7ad5b8b6002e6a8356821bf06f9d65273cd97d12f9c
SSDEEP 12288:cyPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T138F4025B73A430F9D1378138C5A29A05F7337C325B204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 55549274e8af80cea81ed01f0872f8b244bc1c106530c4625f34cde53dc2bcb6
MD5 96df0f8318512b042aa3c23abd3a6054
SHA1 8535a677608d7616df6381b2f0e0ed61d0ae3db3
SHA512 9f4c8eb829ba8ee3cf156ced5d40b9115120b11794379077f394016351fcff5c300ddfc38c2c7240396b4343d8cf6d6f76f98b89117c9b926b91b1ccfebcfa76
SSDEEP 24576:LTHaLl3z0zDQsqjnhMgeiCl7G0nehbGZpbD:LT6LljZDmg27RnWGj
TLSH
T11C0501A9B35018F8EC67813EC965C90AD5B37C5A0B70CA1F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f195f6b0b2d2ca88597e8455e6f932d47047638798da938d750739f5306e9e1f
MD5 3e66162a3eb877c4d9006c612b6cd8a4
SHA1 29d2475029b442469cc8e5fbf19c1a46cd5ee633
SHA512 b22ee9f22b6a0b3370c51640799edd2c7fc256396c56f64da16e32ea9791e9fe73ae84f27166651dbfd8c498fc26d5f9a68c7cd0826219d559c767bafd0b2e05
SSDEEP 24576:b37d9CHKy7GZUsqjnhMgeiCl7G0nehbGZpbD:77d9CHKyaGDmg27RnWGj
TLSH
T1CC25CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0bcb85a87975cd815eb528319037709d6046e978921103e97a134971a0481906
MD5 0e68a6891372f1f563e4cd22b11de94d
SHA1 fd9f11048b6f62e44b5014c426218d221ff6c2cb
SHA512 e9f10d4e27eb9c2089924f34d4d78117f64dbf42e78e98ad07522b95109a886d403a21ca7d35f94278289bcac9f2735df8bc798efbcc3be30203a81a9df759bf
SSDEEP 12288:BAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FAC423BE914C01CBE92644B5C3E5E15DEC173E57E9200483BA9B78BDF7F28684B39462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 5c58d9a39b1a3ff9904656deb0ccf1dce39448e7bef65f964c5eb0b1fc7a4d0f
MD5 ca089265619cf2d99f9fb9f77b15e344
SHA1 bd42648b390ce7ccb7050bd4acb06edffe6e35b0
SHA512 b2445a9db9fed084a44e3e6770c25eb65925bbc73be6b2843d6ddbe777f698c3ab367a1056b8f8bff78dcefbcde4be47419d82222c52438ddafc89ba6b9ff9ec
SSDEEP 12288:1KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T155C423BE915C01DBE92644B5C3E5E11DAC173E57E92004837B9778B9F7F28688B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 8bc7f7c3fcb2ff56b5f0bd5400046e3a294434dba6c3274c69babffaf0dee7c7
MD5 6ff579e64531ecf97652fb1dc9d70b7b
SHA1 89f584871b7762a1e54e6c1a6a29d4ee0d70e198
SHA512 a6553b94f9176449fdfc780b19cfc368a2e8393490ec8ff7e4a877e35594c3ff4346368cc76630e934ab18c030961afcad74782e255ff8d13d7ff4ed09a1c815
SSDEEP 12288:ZNsfjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ejsqjnhMgeiCl7G0nehbGZpbD
TLSH
T165E4015AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7a483c927b8e22f2999f40032811266b536e0d36ff07f7574fcb7b6a41e46edc
MD5 b7177b81bd9df25f94ab0399ff4efea2
SHA1 a5272fb62544bf718f01dfd245a697a137de890d
SHA512 37448db11c4fde163f5ea362c8114047cf8cc149c0ed3c86b5798eb03580e19d30a932bde34c2246b50aeb78508a2b7670719d65ab13dfd0f6dfbe6b82191e07
SSDEEP 12288:HnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19AD4237FD34C118BE97605B083E5E12D681B3E669E204483BA4778FDF6B18A48F39527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5de2aa807cb54a8bd751a3ced9cd7914d870db7026b62861f3dcd6980ab3a1aa
MD5 a4b85a4cc42dd9428dd3ced17e57d8f0
SHA1 2ec100ae35dead2803bb1bd67c87888f24f391d4
SHA512 2e1514f260a42697076be33588b074d35424e95af534e73fe32d4af165e2fbb5e5e9530daf0efcce2633f7dcfbb6e22691d66a1a98b3be850b97a4afcdb31d12
SSDEEP 49152:aa0h2GEkuAe73q3pp46zwwQFDmg27RnWGj:aa0hNYG4Jw+D527BWG
TLSH
T1BD85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 0514b51ca32edc5af14314fe0b7833078ea9f2951ba025f0e188bfc8c09d686c
MD5 6c0d9aa42ba43b21ef73cd9d8aa44d1d
SHA1 a21aa0551251ba27c94c1514b6a136d492715e62
SHA512 ca1d03830d555903269043fc3d287d1c9202eaaeedb453468f05a9c82a84c77b3c55474e5f5351e35f97811e4cc312a48c3a8c296ac1a197cad9a0046c775062
SSDEEP 12288:ThbHjfX9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ThbHjP9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AAE4127E12AC20D9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 882b285be3aacc2167e14868f636236a34ccdbd468b923023001cf00ba7521ae
MD5 29d34ae069db07d861a73dd75af66cfb
SHA1 acb97f7bf76e184910f83b933786d46f55795aa6
SHA512 f4b00f6e68604545820459f5a4877081a415298fa248acf5c30becea870b600841173678e34e888ad2783c4de2f14df40d0fa4fc244258c6f17bf9bf264f2c38
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/1sqjnhMgeiCl7G0nehbGZpbD:0IgnaTk46pBR/pDmg27RnWGj
TLSH
T1D445BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 f0511f2f34bc81e5d320540b604be1692addec9929b535596e61887b29fb4584
MD5 a743c0b8e0b0bef9f87e90d646e9a51e
SHA1 3e8283093e92fd32852ebf8f23e436dd454ab1ac
SHA512 cda284da5f1c96b6c41c23923282c488a25c514272a6ee6776bb406194f122b3bf8088d19358f5ea0a1404ce2625dc37ed54863e50f4d0b9471fafff501d108a
SSDEEP 12288:ZTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T169C423BE924C11CAD93645B5C3D5E11DA8173E56AB2008C37967B8FDF7F28E84B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 6144056d1084c75cfccdceac3603d600ec88cb28dc23f7f542a4f46228a5a994
MD5 510dc1ed3a4b6c2cc9c436a4e5fd7522
SHA1 e8ca0d387f34ae2a394d972b09997aff8e7e4727
SHA512 cfb949e66cf634ac544b6bb07c969de54783d5da895df4484d8c53ea982e7c4960dc0935f319908b11fb0db4cad333c1ebca63f08590ddb52cb8d3b0be342be4
SSDEEP 12288:0Ob9A4LWOsvAYFTQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ZpL3UTQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T172250159E79800F9E87B813CC5A2D616E673785D0720E7DF03A94AA91F637E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 6318235bb1d31653ef8243adf90a1e127a3ccbef7636a3982cf9cdb71dac3c32
MD5 5efdf1d9f4f8cc44fe8c503c1f303988
SHA1 a4fef646931f65434c9fd35e20be5fdfa54cda6b
SHA512 70243987681911fe12f1af9f433e4373070aae9468248306d5a5f527675399743f5ee8e8461dd537fec395b6a561ed11e77a9eb95cef684bc883a6358ffff6a8
SSDEEP 12288:BpFtpO8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RO8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10BE4026E32DC10E9E536A17C8692D20DD6327C661B2117DF06D180BE5FB3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5c758be492bf866af85b69da21cf2a130d147bafa0a28250bf423b25fb40b54d
MD5 e10154dadd4e6f74e66487356aa8a97a
SHA1 af1de1b9b182aa5c50af897f5f046f9509148f2c
SHA512 5d18350fd09a9849f159b77f486a2716ab898c7b909f869f494b3e24bffeddb3c2e05544dd3be6b4d549c1d6ec34701cd1e36389adaf163112a35aeda62bfac6
SSDEEP 24576:C7NM9YqZqmWMUkPjZM48Mv6bEhsXsqjnhMgeiCl7G0nehbGZpbD:C7cBWMpPjN8DbEhqDmg27RnWGj
TLSH
T11E65AE2E6BAC81D5D477D13DC9E28206F6B2B4611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d3231a03c7367accaa525c4fc713d7c81dc2690bd760e9dc80809844ea1ef574
MD5 f2396d4f213d0684fec94dce7af4a332
SHA1 ab8e24ea88774d4d21caa8d6c428250624c798ad
SHA512 008e8304425fef727c349a2a57e0d4105c9e4ec911cb7285ec1544611109fe73f38aa03c378468d13d3279947a5f297c34975c12c81a485157bfaaacd94b2565
SSDEEP 24576:hW6BApg2YuyuNDYTabvcdvNYf8km11sqjnhMgeiCl7G0nehbGZpbD:hF2YuHNETovAvNYf8kmLDmg27RnWGj
TLSH
T162857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 43c96ffab80f07f013de80d487d01b2964b9683b186fdabfd77e43edfeac60dd
MD5 cdea6a07a691bdeddc297340c0f6ec19
SHA1 300ef624978460ef0e232095815d29380871b63c
SHA512 2cc05550a8a43ac23e8366888d345f265c7db7642a64358796e7e623dff61eead96d6f65884ea71e52b3992712f60e1d6d4c781a92ee834f34e2d2c71b266087
SSDEEP 24576:dAFs06+Omlf3NXEbToIsqjnhMgeiCl7G0nehbGZpbD:SFs060lVXulDmg27RnWGj
TLSH
T10B65BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 3f697ac4b70c07a92dfd0dc83879515619757f4369b4044f6b2192dde83a409a
MD5 45f0df0bb540ea5300630240a905e815
SHA1 3bd23b678034356ea666b3ec86518e38156b83c3
SHA512 f1723989c34c8ce55ad41094b9a7dfd595834373abae12f95f11ddc61aec8d568e366c244da5bc14352f93c0073bc39a8220c9cb5f7f8c86192fc6af6ba1c9e4
SSDEEP 24576:pJnJ5D3WXRsqjnhMgeiCl7G0nehbGZpbD:pJnJ5DGXlDmg27RnWGj
TLSH
T17E15E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2447901bfe1b5a893fd1988608cc7451f131b0eeb12bdfc16947a15a6f23e37e
MD5 207dee330ea6d5f575364f69962c544c
SHA1 637ea65322df26a8fe894a9e584fa4b0a53ced19
SHA512 ec17fe89fa797f8b6020094be1a3208e4d7395f45b5144cc4f149aaf5284c08d87b855557c3a6b91dacda31411bc2a34f9190ddc1ad37f94746beec6159e0d6f
SSDEEP 24576:3EPghm6/7IIXdwcXrif7qQncjlP65i3VuOsqjnhMgeiCl7G0nehbGZpbD:wg06DIKdwc+eQnSt65aVfDmg27RnWGj
TLSH
T16D955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 2149dc27dfa742a7e2e395ac9f87ed2d152fcc8a6dc19fa28efc2945b18b3454
MD5 a17832305a305bba883db3e3916ea66a
SHA1 9b07ab5f36da099919dc3bb673e37737f2295453
SHA512 86cc9fdaf8cf6db93a81a0478a4e1becdfc3be7f46246d3ebf352cc39da6e898a7264a76d2cb9f240bf06d627fee5c7c06bc0eba0d1e46759208a5b3bc32890a
SSDEEP 12288:zEP3Rn+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4n+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A2E412AE679C60DAD536907D8291C209D733F4716B2127EF16A2C17E8F739E84E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 c449d0be368a02c9d564945af59d8c1d21febe42bc4e633008969d2547649a79
MD5 c8ae1cbdd201c4a5a3600bcb313de521
SHA1 67ecf474d2ec2b7bf392531ac8979b24cf994c11
SHA512 ae66b347f6672903a3a545bbc139da79714325f6e9ed8a8272c748bfa8a130493c255de5d55455e55db30fe5ad13409c2e55ea6f9772b03f733cce96413bc7bf
SSDEEP 12288:ljkyWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lIyWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T160F41259639C60C9E9760578C6A3D1589C32BC31AF2046DF6191FA3EAF73AD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 793975aa5453c0a11367167788028f3f365685a4c020dea973ea1d674d3ff19b
MD5 2796b547ed227594d56e98549ab55b1a
SHA1 a67066e07311cc624350ff86e0db60c09c85cdb6
SHA512 b6ac2578c3c9b4c136d8caa4fd5f6c5b36bece7d143f55a27f39a350c5cf443fc7af62d917b91ddd8667acd368d0ceed6e7b35d4f4f47061738ad80c0acb806f
SSDEEP 12288:ZyMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BAD4237D525C21CAE93244B4C3E5E51DA8233D36AB2018E775E7F8B9EBF24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 69b8217186ecdec587c72b74ec989d94f9b814b28edd5484bd120156ba1c834b
MD5 f457786091d30471e13fc32ea8537eac
SHA1 00a0af75a37549a7c0949f81d6c4fa44838f545f
SHA512 b7d6227fab67a49479d6a9bd7ced9ae487ba9486bac20f6222dbce4869f1708746cb7a926b40c08f66dee98063811a937dc3640bb7ff28cfdf381d61e4755d6a
SSDEEP 24576:OQ9MxZKdcz9dw3vsqjnhMgeiCl7G0nehbGZpbD:OVKZTDmg27RnWGj
TLSH
T12D558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 022c26fe21e790cded2b863daba9f63cd3c06a6a081dabb5c29f7e0814747ca8
MD5 55c7b81f345a01f49ffe580205016702
SHA1 5152e0aa6d91ef17f34f857708054b6a10516bd6
SHA512 069528b03076821469ae630c01771b102c536bff57cfa0b8fa5a4b1d54e887bc4b0fdd54367f9728d6ec2c09b29c522486997d85b47ee81fa01ece39742d486c
SSDEEP 12288:EyoKo2JRple9pCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:EyocDApCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A6F4E01FB76D40E2E176813C8985C249E673B4315B2157CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 84190f40f8f5a819171763bf4812ed9549affe25e10302377a6ff2d4e34712ed
MD5 96f1a7680f5833ef4877ae4807d4ad74
SHA1 bab8b56a564607967c556d53466e67e6202144a1
SHA512 f87e564d2cee22507949e56190537a1cd3b843fd371ea3406ea4d4caf1973f3ce6a97863f8a26857388bb83f6537f1bd2eafdad121db3def20b9cc30e9274834
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKGDmg27RnWGj:T0zuNIMD527BWG
TLSH
T1D7A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d636f5bb71ef3aa70db7e03281cd6aa8d6bb1f9da3838a0d93a77b853c17606c
MD5 00bde658d51a41afa8b9a0a76dc9bf79
SHA1 8710483c5ef5d5d37eeaaa19f3ef16c3c5acca64
SHA512 d57fa536ec76f5da455138447ffe398d5f65d2b050a88981865475004ab8f7c452ea603c3b6d9d3f29655e772f66310dc546327fd327886851fa212cef4fd6e6
SSDEEP 24576:31QT7EcpfxR+N5AWAz3ooiYtjMqb+sqjnhMgeiCl7G0nehbGZpbD:KTDxR+N5YzTfjMHDmg27RnWGj
TLSH
T10E55B02EA7F815E9D17E85798B23C516FA727821033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-315-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/60-261-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/60-267-0x00000000006F0000-0x0000000000757000-memory.dmp

Download

memory/60-263-0x00000000006F0000-0x0000000000757000-memory.dmp

Download

memory/176-77-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/176-235-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/176-71-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/176-79-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/312-278-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/312-400-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1228-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1228-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1228-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1228-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1604-257-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1604-251-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1604-247-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1604-311-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1624-410-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1624-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1712-243-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1712-307-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1748-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1748-409-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1828-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1828-39-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1828-33-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1828-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2188-288-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2188-403-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2188-282-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2188-281-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2272-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2272-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2280-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2280-443-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2364-319-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2364-444-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2496-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2496-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2496-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2688-382-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2688-405-0x000000000CDB0000-0x000000000CDB8000-memory.dmp

Download

memory/2688-398-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2688-366-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2688-446-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2688-450-0x000000000CE50000-0x000000000CE51000-memory.dmp

Download

memory/2688-447-0x000000000EBF0000-0x000000000EBF8000-memory.dmp

Download

memory/2688-328-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2688-449-0x000000000EC00000-0x000000000EC08000-memory.dmp

Download

memory/2772-6-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/2772-8-0x0000000140000000-0x00000001403C1000-memory.dmp

Download

memory/2772-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3000-323-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3000-445-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3380-404-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3380-293-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3380-300-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3380-294-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3420-204-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3420-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3604-82-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3604-65-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3604-59-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3604-80-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3604-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4576-435-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-424-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-441-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-440-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-439-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-438-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-437-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-436-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-412-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-434-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-433-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-432-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-431-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-430-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-429-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-428-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-427-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-426-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-425-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-442-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-423-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-422-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-421-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-420-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-419-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-418-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-417-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-416-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-415-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-414-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-413-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-411-0x000001C6BEC40000-0x000001C6BEC50000-memory.dmp

Download

memory/4576-454-0x000001C6BF480000-0x000001C6BFAF0000-memory.dmp

Download

memory/4800-407-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4800-304-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4936-327-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4936-275-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4936-408-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5092-271-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5092-322-0x0000000140000000-0x0000000140095000-memory.dmp

Download