stealc | 2f025e7b7a17db593f07bc9d0581a9327dd80b5b6c04791decbefb12ccbafb01

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/09/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260915-1chbsaha94
SHA256 2f025e7b7a17db593f07bc9d0581a9327dd80b5b6c04791decbefb12ccbafb01
MD5 d45f680ea8b75b4c23c2820f6918ab14
SHA1 bc456800c5a2e029d99999a092c3a3912d7f42dc
SHA512 026d31f6361bb371265636abc8af64e9a5eb3b86a6d1eecd0ffdcc0945141092c42b15fbeab6a678b66f5157872550a751085c622abda29bd17eed2861a2b650
SSDEEP 49152:DO321nhCy0kbyXPvXYu5e9IhkehSAdToxcDNl/OdARSTq1t3Bj+LNiXicJFFRGNf:iuby/vXYCnTNXY7wRGpj3
TLSH
T1AF067C57E6B941E5C0BBD0388A469A57FAB1384A873197CB47A0475B5F23BF09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/4112-85-0x0000000140000000-0x00000001403DE000-memory.dmp	family_stealc_v3

Executes dropped EXE 22 IoCs

pid	Process
3420	alg.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
4876	fxssvc.exe
3120	elevation_service.exe
5024	elevation_service.exe
3752	maintenanceservice.exe
2140	OSE.EXE
1100	msdtc.exe
4656	PerceptionSimulationService.exe
1652	perfhost.exe
4720	locator.exe
1120	SensorDataService.exe
2164	snmptrap.exe
4636	spectrum.exe
756	ssh-agent.exe
4764	TieringEngineService.exe
4304	AgentService.exe
4168	vds.exe
2632	vssvc.exe
1204	wbengine.exe
4360	WmiApSrv.exe
4228	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3ac4e383a26b1277.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f1062a35945dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb08b4aa5945dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f12ebbaa5945dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075c334a35945dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000142556a35945dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000801bc7aa5945dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc149da95945dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004213bca95945dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000256e78aa5945dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed7164a35945dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4d728a35945dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000727880a95945dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3120	elevation_service.exe
3120	elevation_service.exe
3120	elevation_service.exe
3120	elevation_service.exe
3120	elevation_service.exe
3120	elevation_service.exe
3120	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4112	2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4876	fxssvc.exe
Token: SeDebugPrivilege	3772	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3120	elevation_service.exe
Token: SeRestorePrivilege	4764	TieringEngineService.exe
Token: SeManageVolumePrivilege	4764	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4304	AgentService.exe
Token: SeBackupPrivilege	2632	vssvc.exe
Token: SeRestorePrivilege	2632	vssvc.exe
Token: SeAuditPrivilege	2632	vssvc.exe
Token: SeBackupPrivilege	1204	wbengine.exe
Token: SeRestorePrivilege	1204	wbengine.exe
Token: SeSecurityPrivilege	1204	wbengine.exe
Token: 33	4228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4228	SearchIndexer.exe
Token: SeDebugPrivilege	3120	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 1920	4228	SearchIndexer.exe	112
PID 4228 wrote to memory of 1604	4228	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-15_d45f680ea8b75b4c23c2820f6918ab14_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:552

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5024

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3752

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1100

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1652

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1120

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2164

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4636

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4496

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1920
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 35ad54ab40d01edd8432cc350d29f1dbf3490b921aa937373bf5f65bed57c626
MD5 362f566d8411cfaed40e59f0c0065c1d
SHA1 cd9da5d80efe7faed4d2cbe33e21109230a5cdeb
SHA512 d3afffd4324a6c5ede14f7cb9eb7f7f24ae0087b45189f2c15a99b30e3918de868aba23126db766c6884d8cbfad82453eb23e2bb94866da92a7b294bd8dbf79d
SSDEEP 49152:eb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnuLNiXicJFFRGNzj3:g3q6mjB57wRGpj3
TLSH
T155D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b310926c5808591c178fb2fa945f9a4842ccf4b5aca4ff88c263ef38e0b6df6f
MD5 71b6bfbc1174ffc144ccd22c467e2092
SHA1 be5e12e0718e9bbdf01803e3464bac11bdf9f750
SHA512 891aaba4bf2d87dd9d7a8d01571897763eb19b24edd978f1febb42e44a704ca692e8ce5143438b068af9e140fa695c058f3edee51b080b84dd0706fda0a534b2
SSDEEP 24576:9XYfDtczAV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:otcgLNiXicJFFRGNzj3
TLSH
T10875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 246d12d118b8ca8775f0f3ff6d6fac810da5794c990abc8545ef5ef855840403
MD5 5bb256116f13837df86d4edb4d138c28
SHA1 b132838e260afd1ee53f7a44daffc3511724e092
SHA512 918b43a0695a3a31d39d21498119d3ff0819000df7af6d757a074f4940cb129ab61eb2d77d84d1b79ea1b40010f217dfdb4c98290795ed011065decf71eafbfa
SSDEEP 24576:G0Le5ji0hmxhrMW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GPji0AzzLNiXicJFFRGNzj3
TLSH
T12D859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f373279dcdc77e051b313322cb6d055079fca6c68bff9551ea98b4dc61872b83
MD5 194dbf1aac1fe84f5d6927b22b020aa4
SHA1 12f639a704429d3fa96ed5a67b568ce0f584716e
SHA512 2381b5c116247e7a04463a4b502644a087d91c3931a7538dd43c808a17ba17d73df7145340f5bac724678d179e81ea79d5ee99a6d8a56a8de3d80ba0cf5a809f
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWj6q8wyuQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:V/ezSC6vUzPv+Hjy/LNiXicJFFRGNzj3
TLSH
T1E1756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6d27ff157ca78e3bb0468ddfe61de2e9ee30a1beb39cd74929da11560d63ff3f
MD5 5a9847f6ee88024d47cd55478f0da26e
SHA1 faf0dd53cd810a7f4606a0a7538c75df6f1b1dc8
SHA512 295aa88099f0ebfc4afde0bbbf3259ed259d11b081652223f9e0f1f95105e055dee4155bc639113ec3dbb082bf759590ce0b100e28fd646cfb85d19491733b0f
SSDEEP 24576:VVbqPb88hv/l+Bp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VVO88hXl+TLNiXicJFFRGNzj3
TLSH
T1BA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e62b76411d0cce545101f609d7d4798ee8358e8ba613ef41f1c37a2cedf0d02f
MD5 c05e8f9968f0e1d33e71025d255a5a0f
SHA1 5f997b6b48da016439a870b9c70ef8064dd0f153
SHA512 74c551c6b02415887d087a159f0e01a8949a484762c8c8138138a7a9951df886a9294eea3fd24d62a907fc70d334d4efa2221ff1f241714cc7234f68174916da
SSDEEP 24576:/Ga/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LLNiXicJFFRGNzj3
TLSH
T1BE5523D3468854B1FBFD003A867A5828B5845E2C8A595DE2D2543E5EE13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 53dc387a60f9391808dc272c9c515fada15795fae767cda5ef307f8fb9d356ea
MD5 418c87001343fdb5edcd269d8d177458
SHA1 ae1cfb066fe1ec704bcc4db243c772d34b884a31
SHA512 bbc0f3cac18675f623ffd44bae0aaed475236a6cf099c02161571221bcbcd04ad2d04ca67528cd5d89f72f5686ad7b9547a4ec2de65acc86887cab4e20454b7b
SSDEEP 24576:zJIUR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zJIURLNiXicJFFRGNzj3
TLSH
T17075CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2b9855e0ddb336dac325ab7f0099955c755c148e7b1dfe25d95a6309df80d17c
MD5 fb8cee019e0bd553989799db69761552
SHA1 c35e4d6bebc4707ef84888344b3d965fabd6df99
SHA512 630c5a3cb9f157c20ff7506cf2f4b8e410847e49e4b943b32a2a4015dbee4185bc61a1479115367b123885839a38b97ceeb74efd4b37ff084436f2c522f0f201
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THx:yQvGAdlCEL8c/WRNw5CA7wRGpj3
TLSH
T1CD266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 42a76ffe2bebf733f797ed0a408e6bce94f3caa4d6458aaa8969aeb57057b8f3
MD5 2b49656be5dc1558e47b39de334b44f1
SHA1 610d8035f32ac6eaeaf4f60c4edd22ecae5da301
SHA512 83bbd37650e127e1e755dc071774acd3ae61ca3cca089eb8d64ca1579a67754ceea05b81ac50c428cd9eea407bf79a7ac1f25cbf92422b636f044bc0db129bc3
SSDEEP 24576:wfewsAjj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aljjLNiXicJFFRGNzj3
TLSH
T10A75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 40939311a7577bac097f70dfbd7fe965798f0b906c2e4af0f60a3f023362d175
MD5 2a7b0ec722e399a92c1c70d49e43eb47
SHA1 61f15425e2dd90968ee92c0e24f40fe1edd98ff6
SHA512 37c9ed2309b0e88cce8e0b0111b0bf6d9c582acd74291f2b8571e8e68b85cb5621045e4b74d5e6b6d0e512b35d0666258e97675eedb25925aae17cb93210bfba
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHfF9:eUEtQevvqc2W1cpV20I32t9
TLSH
T12C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 717b5e3ca7d8c00afa4ee234bf85d168656c37ea75e4f23ce2d21944186bf377
MD5 8f5ebd66b5c916f0ff7aa76d67becc9b
SHA1 f56747a463b1f889d5f3be015fc83f11dfea1d53
SHA512 7d8362e3c344c431480cd6c0c6b6864bbc8822dead1a7af513441580ef27607270f8c0031308c4ab6164508d505d34dc28a71731dd7017503ba118cca47803ba
SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/zDLNiXicJFFRGNzj3:ioq2Vjnms7wRGpj3
TLSH
T131D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 43b5ce5ee173608d8f02edb2814d5e834455240126c3dec57280cd6a6bbd1d06
MD5 e6fb416c38e0f26e1ef22f380eeb4476
SHA1 a7c4ed3cc0a5a11e63b343234d28be2fcc47c589
SHA512 d32c160d5a52b60bea3f6d62e3165fe23fd83db0cbf1f8ff384aeffcd3face6dee5e81eef3d8008416097617896c8db30fcf782ed80157a8ce51a775507cfdf3
SSDEEP 24576:0AhGL6IFoiwtA5l7S53M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0AM5Foiq5cLNiXicJFFRGNzj3
TLSH
T1E5359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 aa7f882a67a77a5e6cec533ed5af68ee7c7ef5c5d90ccb84349693be69437812
MD5 a2809a2df3bcc5e7b59953dbd885451b
SHA1 c15257c3baf28f452857d72e9fb5c1a9b0ae5be2
SHA512 37ee424b38b8d352d457403ca6c4c7457be4ded8cc67b576d5385e99c9584503b2bc22853ba209281a6fe3550953e2115aa1e7aff641144950be650a4334cc32
SSDEEP 24576:ZwuROWf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZwSOYLNiXicJFFRGNzj3
TLSH
T12165F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dc89d750eb6221b5f0501ef09b7efcaebb94704e8d69a85dfcc4372bd16b1b0f
MD5 eb0de946050f9f0aee370ffa84c29977
SHA1 eb63ea9e56014419d19901b6d6104f8ea84077d2
SHA512 53bfa7cb07e25a14b3f223f73fca66c087c5b8ef81eb4561ad5347e122d0afc4c979a1e61ffde474ad9f1d21051abc86698352c2ba27b5cccd6ea87912350316
SSDEEP 24576:xZue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T1F455129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2f34850b295418e597633ad2ef08e7dccf6edbf26bd7b794eb9429291895f0ce
MD5 27b7bdf08c2b546ae8ced6fecc951768
SHA1 697c0adb1d1cd7c3c3319eb8af33555c07e1e04f
SHA512 02759bcbd2f85a7c31512851d31059499e6c2d00db2442d10c6b0471f6acb8d31ba26a3fe7ae4cc83768e20fd79337827ff5709b964ec1123c1568912b09b0c5
SSDEEP 98304:6QRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:xQyiKanX+PNRF9
TLSH
T1BE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 57bd80a46e93cbe10e89fa5223155efea7045fb90c84119c6cadaf46f1fd21c1
MD5 07f854299725f54eccd368d3bf7e83d7
SHA1 9602c46fef49500e9ba10900eacf21b182e569d7
SHA512 4285ea4355691e3fb06b062fe7de4dc650df61ee568abd5a8cf0f548724e5654694a9bbc3041bf21050c633f9f4ba0636e614b9677cd1f52b3badb279e9c8ae5
SSDEEP 98304:8QRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:jQyiKanX+PNRF9
TLSH
T15C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 93bbf9910b4c6587b2e6b4a285ceb0c89e81a598dfc528cea72040945af1ada3
MD5 085b7cc4c5476374c420612c04efef4a
SHA1 0127026f5a3e22fc1679ad3bc6929f336410f1a7
SHA512 efadfc205051d6216cfbc42fee9c0f52744e3fb61dcf6cfb3b16e2011b4a39c39f5b402ade34e500f67faf6a82a99a45edc4100323a84b71c0ac3dcb8dcc93dc
SSDEEP 49152:J68Qg55nhkeWu7PNU3/zLNiXicJFFRGNzj3:XthTRc/z7wRGpj3
TLSH
T172B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 be8a0f72b8d00d8b3310f02b6899e19b4f379b1f123ce99d2d9a8617fb008ae9
MD5 30e0f8d281c6cd73bf911f7bb96ccabd
SHA1 5171b74970a1b6a68633734b9d9f95ed9f3debf4
SHA512 652c687078b1320a7b7986e3d20b8791fd67479349bc50db4b2f1b979398ba810ba03851342e16794de5c172a70ea508e416dbe4850accd1e2022c1aaf8ec0b2
SSDEEP 98304:by5112gYy5azzVvU69nLKnhZa7wRGpj3:2LIHRWhwF9
TLSH
T149167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0cbb19b8929ee85d4e46985d5a27f30e53fae4fa1318209ac3dbd3e7981d10b8
MD5 ec696c116a05f9ad4dd509943229fb24
SHA1 63eaaff4221d07be72cb4a8b7c2478097ab7126c
SHA512 be804be7827b61dadfe00cd6cf9b02dc21479112e8a4fff580b08e1fb1b61ccd6a5081adf143c3168c07baa537e7ee16aae4618a7dab7b01ad72077649c1db3c
SSDEEP 49152:5B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gllLNiXicJFFRGNzj3:vu6JmIxd2dl7wRGpj3
TLSH
T10FD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 32be5c94b1109011fe8a9480a76f533404c59f51e73a7938baaf1ea3b696e14b
MD5 4093976de3ef86d0cc50fa9060b78dd1
SHA1 ec18ca95fcd95de16cdfe13d0260cb8500ee7333
SHA512 5698fe0450e05cdadc3b738eb65837f33d3b50ad4fc1108c2a1ba18589ab8d8e229777001532723ea8445872138175fbf5d803bdd40c525433c304531b027efd
SSDEEP 49152:R1hpsNoJpF1A67U44CwH7R4xxLNiXicJFFRGNzj3:RmifPqRs7wRGpj3
TLSH
T181B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2b3a5abaeecd2211b94b4b59bf9595bb861d8c699d141c96ad8e95b5f31ca611
MD5 044390dec9a0ee6bd3293b5206bacbd9
SHA1 e1957cb4d158326d862d0994077a1261044dcfbd
SHA512 1f0ced5b97dae73c843e610c5875c978cc52f2bf8511a1f31664dd37511432bef35967787d0b525bea778d355672beed1ab88dc7a35ee8496a67e5237798dee6
SSDEEP 49152:gSuZQIY0Be2KkRVtOnks6NMHqeLNiXicJFFRGNzj3:65dKqi61e7wRGpj3
TLSH
T100C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d5b6c6dd36c9744b4e63aec4a6de72f0658ba0e71c68d07c38e491b5a2788083
MD5 5ed0fcaf4d4f14b1c25a0a1600e77004
SHA1 cab2cc756675ce6725b9f8cc32f3bfbcf538fad0
SHA512 354b40de8ea0033217fc7652158b6ddcbfd800db1edc8ab9730086458cf67bf2e788c100e378d2ec6e56ade64479dd2e40290d8bbbd9cba0261ad6da634d0bf9
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wVLNiXicJFFRGNzj3:FX2iWph47wRGpj3
TLSH
T17F95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0f77c2aa8262f55c3a04688b1be818eb0eb4f9af5022ed955703abf02f075300
MD5 37f245b459420acdad1b4353dcbe38a5
SHA1 f9c8bd99a06b83bd07e4f416db31a2be095afc06
SHA512 b88a5d0804bd43b1f11555ec6b5ac7f20f7d3c61c4fb0012b870c27b42ae4bb9ec5dca595f1868db3eca558ab5fc88769fbea88954bf925fe30f983c048b9e67
SSDEEP 12288:QwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10F5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9d7a3efcb13f6f25802500efe55531ef63cff02f9934c261911d169e3ca90359
MD5 377f183205ab9e4cc08d11aea787d40c
SHA1 236fb5a42082120d3647b9616ed903dd80b0e6d7
SHA512 4b1087ab38785a66519ea667b7fe89230686fdef28eb3b6ffe0a97e91473531ef2ce2cbfdb17cddb3b86f659af6b8237561e51d41567f146902a499b89a69120
SSDEEP 12288:kjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D2548955B2FABC0039C6754428F5881E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 481b97a44ada74ea8e70e3abe3bd87f9418d6c8761f1fd4941e92e802c14ddfc
MD5 45b18bcf4de93d5cb66198198bae2d4b
SHA1 b5f45f099a6a6c2219e13a968c9f589d9e2c2860
SHA512 b5835bcd7c1e05052fc45f645d831adb06987cee288e675f1161f55050f0df87411820853cc7e75b3e79a9857f9b70f8e1443b23f565bab6b1c0d3223aa0333b
SSDEEP 12288:dViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE5523D2548955B2F6FC0039C6764428F5881E2DEB5619E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5882a4ebfe1c9514e314e92a3f708a7a5626d7375c13b9b8919fc9c17fd9d777
MD5 e17becdec13bddc5e3fc8adf40b7c130
SHA1 2aefa798af09269fc97a376c487146b6fb885070
SHA512 3eaa04b50a908622e4bc012e3d02cab7a7546c2a25342bb50bfe93bf6707f1444916b4f0e10d51159efaa815a5b05b239abf76ef558ad8801e18a275b90738d7
SSDEEP 12288:fVqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T187552392168900F1E9FD8039C6764424F2A47D6CD7365AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3d769b6e9d64f5f8086173b915e5f175f6331ac25ed6f2b3b9d74d8efbae66b1
MD5 17a608c592776e20d9286f1bf34e3863
SHA1 89dd99dd0446ba5c17c4d5894ee2512e2347b3c4
SHA512 dfa439e5b9f10de5f70c86f290cf397f1d830196410f6cc2f7165cc90bb58579f0dc71203d0a326cb40dbff378e70cc2ec7c1028c1380aef7590eef6f56c6d38
SSDEEP 12288:sCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F45523D2548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d1e1869d3a015948001ea2034b4b3972297625b34db77e12f220b671a80b3689
MD5 13cd26a36aac5bd35a993d43787cba24
SHA1 8821358cd79b2202b4d85786681308646e47c4ab
SHA512 8aebbca14266962e6e8a9f98745142064c18bd1875d8171d2fac9e2dc36a1154323cbae56e9c279176a6de07201fba97bb32606ced43f1104860dbcae49306da
SSDEEP 12288:c/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1705523D2548955B2FABC0039C6754428F5881E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0e3edeec3ca73e54d3ddca325eb97f1a9a346388aff25f27adc76008a1d1f99f
MD5 9b9b2827b2a5f10c7c015c94509bd86c
SHA1 f05d8eb42461a59b13087861de86a07fec414bef
SHA512 60f0f18786f3f7593f471df9230ab2c83fce38de387a7bf61c228028005e6b47ca92a9991774e4cd2b951a26c655bd9faf9d945a66807b3bc4b66b2dac98e505
SSDEEP 12288:d7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D2548955B1FABC0039C6354428F5882E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b0e78234bd994d47e0d929c4aae735ce090c23a2a774b23f4e417363d5337c61
MD5 c111ae4491b8a7ee22f0cead7f7c3e1c
SHA1 baaa29dd372917ab8bbaeec11c376eb0ffb4df5c
SHA512 6e4738d6ac2196ecdd665b87b49e00d47f102e513714a8f615fc6f98264325b1ac14ccf64b33fc53316407f4551959e436b1ba8ec25485c177e3d839b1e71359
SSDEEP 24576:qZM3zFVSO3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qZM3zf7LNiXicJFFRGNzj3
TLSH
T16F750295B39018F4ECB7813EC9258815E6B27C1A4B70C65F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ab06eff0100f8b8448ab2231c82ebccffdcd5c063b8ae53cf96da8c125987fb5
MD5 a6788edd648c079dca9f25bb1c02c699
SHA1 3a9c25812cffee7c5470b66f4eebbf6fc711bc0b
SHA512 20be22591105eb49e38c14d5063cf83a743a9fa9b2e66a1d8703e44ada22f226c6bb5fead63f4d837b038ef3aa20b78e278cbf5ce098137c53255f14c6ac164d
SSDEEP 12288:SEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523D3548955B1FABC003986764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4c282a2b09204c553c3c40bdde221b73abb8f92e3ae5f4ab900d70cba4123f57
MD5 53fc375421af9a90ad610d69d2d51cb0
SHA1 6eb5a5c6525201af562c106cf8538a8ba538e9ae
SHA512 5a669c929c4af83bf2879bf09bb5c27f42c1838b2f79f46061caa0ca98f8ef38e07aef5442201d332d058679a3ab629f92fe1992f6bcfd0b996724223b919a33
SSDEEP 12288:C4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C5523D3548955B1FABC003986754428F5882E2DEB5659E3E2083D1EE27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c4e41d18ef5872a9c22a5c8d86a7ce4767665648cb44f1e29b39b0b80234c2e3
MD5 2f50a212cfc2ff603c01c32c8de81239
SHA1 be48074860d7122bd63663f0e2bf1a9c44481b24
SHA512 2bc8ffc848b500ce453b428a5b51118c0526694909c94ce7e25139fe77d86e550da532e101058f326c6b3e966a137ba22d5984f857102ea2b7f40acaceedfa55
SSDEEP 24576:0zyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:04LNiXicJFFRGNzj3
TLSH
T18B650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2c712cb6ff6e05ef24123c661a71fd774e5752b22329227c52a54ed902a14b33
MD5 d5cc626ec49397f39c52b71407a4e2fb
SHA1 3f21ce4d547bd4d3aeef667a8d7fca78340bb2df
SHA512 de9fe47233309d93054f248b3d7e672addc83bb234b45a5bd0b03e98d189558f0bfc9d6066c6aa39151bfb41c51461d726be074fe025fa03c449b5a7682ef4fb
SSDEEP 12288:AEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D55523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e4e14948de63c178e088455aa46897dd4200ecb7e8728316d8ae29a209717f21
MD5 822fa537dd7b3213c68f58563cb86853
SHA1 61df12a26ba55806ddfc13d1bc85ee889ecc3c88
SHA512 9fe9b8646118d45de7cf6935d3d7b1c8d4dff7af534943ddba2170766e30f6c1af2538d0233082075ace8e1a5676919be49000f9a25d75c4dd5dd29786d4e782
SSDEEP 12288:qEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17A5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a885836f1c568f5f7e0a7d7a07ae3761e34b5b03c79c40647824b2a4c3f9afbe
MD5 0579403be6a20ba0a0cc164521cacbde
SHA1 4f978b5f3e9e685d1748d6af3f33d370b1a45f14
SHA512 30507bfe0b1a7053e5dd972a47d68d9b4e8a8d7e64b9544d246041fad7a7aa12e38336269cfda552c70528530cba16d2b788438449b4882ead636f9412f26253
SSDEEP 24576:SzyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:S4LNiXicJFFRGNzj3
TLSH
T18A650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 be94eeee73f46a31c81d95ed336bcd5cad0d914f1f7abba5e7cac3552a87ccf0
MD5 e907e439910f3799c32719a2cc902ddb
SHA1 5e79029d687011163eb4272ce494219c9c5c5d5d
SHA512 4c38a435375eb9c529ba0be6ed1024e2db87482f743346e27abada7b4a59a00d74ef222fda84e01efcffd3279bd7fdfa6c4e0ce0b0c5bd18de1f2180b4fc7639
SSDEEP 24576:qT8aLl3z0zDJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qT7LljQLNiXicJFFRGNzj3
TLSH
T18B7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1400869d60bbc3936442b7bb89fb5d122ec42b772a62320b97290e4c28f8568c
MD5 88a8d810106496bef2380c5855e30272
SHA1 0762a0ba1e640dbaa34aec4a4d18e5dd0244451c
SHA512 3788ae1330d7ce1c51ff58a17d5b5b72f24576a0faa4653c8e3fe932c1bd7c68dca273b11f8a77a23c8e098a9d027c22ef771304f616a5c0222939a2f43e0026
SSDEEP 24576:x3rd9CHKy7GZ9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hrd9CHKya7LNiXicJFFRGNzj3
TLSH
T12D85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 44a12ff292d1ccf8b17981acd6f9a560b22cf21799a85f11d2778ad985348777
MD5 41892fe8553b8ab49a1f26691e6f07e6
SHA1 461b671471b998fa8d52f5acfacf24d5795b57a7
SHA512 17d113de43ff51b43eef80be410edf2f030048dc0b35b82d426e3716d23ec5fbc85bb8b8622d0c371d82a987317fa17a6903215672a93a719d66a6c76cef7710
SSDEEP 12288:a1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1625523D2548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8ec888b494c549f1723c6b7a4cf4e2871d0d0ecf96a32090ba486c24bb1395ad
MD5 857ce8b804750db0cdfd261b34330b59
SHA1 67e2a0db6b9ee0877d1170e8b64be0d7113e2f8d
SHA512 efe8399bd825315e77f06b2a55498ed684e56b792b59d6aaac2aecaa6ec947d4d15c87c99f321883914ec3fd2c78d2cc23490fe639ebc82e30d4238202033aad
SSDEEP 12288:YHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D2558955B1FABC0039867A4428F5882E2DDB5619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 34163ed63d0a4662087bb6e35bb2b81b14fbc1c86aa07246000621f1eb29b5ad
MD5 96372b9a1dcb0456b23773232a49b552
SHA1 2033012fbd469df6e7c91cb27de5069e80a3604f
SHA512 2f2fb2ab4d4a6cd1120896030bb6066d5a0d5ffdd5952a38696d0da1149d1605974e8b155909d0558b77f6755e14c7b834d6b0b4966ea2cfaacd5d61b645944c
SSDEEP 12288:WeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D3548955B1EAFC0039C6754428F5882E2DEB5658E3E2483D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 db23a8fe687abbcf208c2d702a4222c29b5829cdbe0f5e344239a8af8b53b2b6
MD5 39890c718498865a38b8f4b1e02e8838
SHA1 25cb635a785c3dd8666fef258738e97fe78a52e8
SHA512 72ca237e60c14c898a32e222b0a13309e1dd68a617b487a1fcf37549ead9f5d264924478f9f2937ad1e3807cab905701b08e2c04c3f532ff04d3ab47c9757eb3
SSDEEP 12288:Lpsf0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 41f0f05537918865e9867d661614ff761dc5eb7c11c170ba0e20fbbc97421dd1
MD5 089e9948941baceb9108adae456a9598
SHA1 90586de5a80d6572f7b7d5967c1adf6528f33f5e
SHA512 53efd77b657c8a54ee33a5f934c17d342804ed9043041cb2c9e8c0139222c32ee12a6197f63490765b56c785b7e2ddde09e0d58e1a33de421472e18f78111b7c
SSDEEP 12288:SKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T177552393528C5562FAFD103986398438B54D7E2C9F5599D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 decfba760cfc64322e338954c66cea64bb08428a20b76f0ffef29efd8fc6238f
MD5 e49c7245f4d43a2c9ad155afd2dcdb1f
SHA1 95f31e22af93a4897abe941124ec079152325ab4
SHA512 2dd600f3f35184e561335e5a7b4e4ee8cdbb2599a62afe4785ba091acb9fce9c449a8d1736df519369946769240918ae7f75e847af4ae070867e55347be4f0f7
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQOLNiXicJFFRGNzj3:Ka0hNYG4Jwl7wRGpj3
TLSH
T10585AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 3652bc8155eb122b9a5a4c2e9a551e4a6bc95b8363deb0017ba99390ea89bb17
MD5 8e8565d48be2530636b4eb54d61aadc5
SHA1 c37c17891fb8f73321640c19b59702bd0dd0429f
SHA512 795099b078c47b283303658736183997eb0099f23fe186d2fb647994ce222898aaabcff07a07ca7ecae69b1e41c9ecfbe31c7b9cc0240721e6cb79ca83c484f3
SSDEEP 24576:BhbHjPs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BhbHj0LNiXicJFFRGNzj3
TLSH
T1F65512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0848adbf0d1b1eb9bb9de33de0abf7dd9db5fc2c0618e3bef5347a11621755f4
MD5 0d50cdc6d083adfe9133be9b3051869f
SHA1 a9a0f3f324e61886dfa36d974dc7cd32f7718c5c
SHA512 4fe9eb4757196e17bfb22bf565ab575736155cb3081015a56cdb8a9adb50547dd4e0f28de7447400669ca910391f84f292787449261eb3a28e68150c1bfeb2f8
SSDEEP 24576:j3YgnJcRTk4yti+R5dBR/k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jIgnaTk46pBR/kLNiXicJFFRGNzj3
TLSH
T14445B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 2ccf5a5d83960975df1fb46917feee51c900d5bb9cfab14fc0009e8129a25f82
MD5 ca8021796da05a94c3b55d781d5e2bb8
SHA1 2be5a9ddca8648273f70fdcfb65a7dad1736c3a3
SHA512 aacd1e641e479d570b9d1d48741bb0ccf81cb3d9ba100f8012103bcda50d3497dd9a5aa6539ed13f9c97cb11ad1d1d4086a477b58ea546725e6240b6fedd8ee6
SSDEEP 12288:emiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1635523D2518955B1EAFD403D867A4428B5882F2C9B2619E3E1543D1EA27CFEFCF38162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 6509c6c3dfe2d09b3fac1d9e6228ce639ca47df944a5be49ccad66853f91f71c
MD5 1248f0e0d020e2f7fef200d8fb4c9edc
SHA1 952f40b5a8625932ea75f2b48f96ee8e0e09098e
SHA512 9dcce668e0d7d42a92d7570ded60046905c6e7d4740b31ec05630566bc99b8cbab529e1348a58aad8b418a0c7212f9eba818b43784d816e03f4eb2663094d8b9
SSDEEP 24576:aAL3UTj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aAL3UXLNiXicJFFRGNzj3
TLSH
T147750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 1408dd30aab1113dd333f30a5dac06abd240109b8e8a57e5b13bc481deda1781
MD5 aafe10a6196822a204a5b526b3b4576e
SHA1 f4d3f52df5516ff57052da18bf32cfc3498980e4
SHA512 ed1b2f2dca0e8717dc80f0050961d92c2ffdf5f2a20ed7effb4470e48a4b4b02190dad5ee8b78f2df0adf23f441c995d64010450722c52d664d55358a579ea9a
SSDEEP 24576:zO3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zO3LNiXicJFFRGNzj3
TLSH
T1AB55125A32DC10F4E579903D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ea05078e57995818d2efdbb7ee766b8377172f302599b56b84b18ffbbd9fc77d
MD5 2f744f1b861157a97f74028c2c6189da
SHA1 de5aba2450640100cd9045e3061b8396ba8a0d0c
SHA512 5a291a385432c28e7a62c5e5d32535fd7ff0e28707511488b9f464c16905512295ed6ddfbad27eac71183acac9c85d9cd7842d344c0856eef09613c36684c828
SSDEEP 24576:07NM9YqZqmWMUkPjZM48Mv6bEhs8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:07cBWMpPjN8DbEh5LNiXicJFFRGNzj3
TLSH
T1EB65AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4dc660552c73be345564fa7feb921057b3c2b6f626d86d3eaebb51e0500ea163
MD5 daea7b5dd7195d07c5898792767b89dc
SHA1 6e42e5131bfc63d2f4b9467ce5194fede87503b8
SHA512 a45c5ab238e86e8de804af37629ddefa546a96d880b325d58c29ba15c4612030db2d3122c168e73e5273fe2d27da079291bb8e746ef0423034484a0fe65cb553
SSDEEP 49152:CF2YuHNETovAvNYf8kmcLNiXicJFFRGNzj3:L6BCf8k37wRGpj3
TLSH
T1AF858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a50f40982b5c369b42f2b7b043237ba14affa81fac8b458b6b61d59f92d2c584
MD5 6c7784ad36a58dbf7086c8c6ea6a207a
SHA1 4b416d04737e4bef05e5e04106779eee3ef14c88
SHA512 6ca037428732a8b35a4e1446e1c53c1674424c05f74dcef223454d0276771a69f781428c566b770857abb3957bea6b2a5eaa6c235fc1319904c5c48727f5c490
SSDEEP 24576:RAFs06+Omlf8NXEbTor/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mFs060loXuuLNiXicJFFRGNzj3
TLSH
T19465BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 c04b0d7999adae61e7daf48358e82f5eed3f0993ce4519105e39fcf93a4e3684
MD5 c9ea3454406f0b3d37a659394044037b
SHA1 a421e60cc7133336b8be002420617ddef4cdf9c9
SHA512 7e844b9f135fb5e612c6c01dc58589786dcd38d46c3b9bac7477089cfe6fabe594b31df204008ee671604ab59655e58b9ea9216e87166fe19c037514af2f860b
SSDEEP 24576:/JnJ5D3WXu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/JnJ5DGXuLNiXicJFFRGNzj3
TLSH
T1EC75D02DD29810F8E4B7C274825A1A55FE72383D2F226AC724B4D5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 331b42669057537a0c19fe0518e50d9245cc5408d6595f732956e30c8c892b7e
MD5 66cd7c2bf448ac9b55759790dd86ae37
SHA1 cc1cff89a8cea8744009d0945b61ba435f23750b
SHA512 6647403ccc6c16e45189470a49a1adb72788a619f462d4871c358cd7c39de745fde729804fa21b8fef4b21e4110d3887694d539579b50d7e44602b9635de1b22
SSDEEP 49152:Fg06DIKdwc+eQnSt65aV4LNiXicJFFRGNzj3:e67wRGpj3
TLSH
T1EF956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 1c958b4db8fe8756de6ab396b24778e5b191b32438fedf723b9b0a7d17baf3df
MD5 cd27620a45790b94e41ab4fb518e04e4
SHA1 52eb7456edaa8c177ef488647a0875e2cd04d2ff
SHA512 759aa676ac53c706f7c1ca2bb5fff0977db676b6479ac61652df435e7a1c14d28f8d49dfa48360e83c6771a36e3628a50aa56c62641c881e0626c4e136f504e9
SSDEEP 24576:Dnj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DnjLNiXicJFFRGNzj3
TLSH
T13F5512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 89c7dfa5c22dd15eb49a9da256a5d47ceee105db665731efb4266ec33d19f60b
MD5 fef1e8ce2736340fe003a05f763d6b59
SHA1 43e7d79cb8ea7c94a50af4932a18185d717d869c
SHA512 c316acf5bc1317d76ca2e53f3e43e6892e49e02657499af1435050c430ff1acfb88e259b2c7468f3e34827129d84ec8ffd3fe88d5e46d6bd1db34964b5865fe0
SSDEEP 24576:2Iyp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2IeLNiXicJFFRGNzj3
TLSH
T12165124553C860E5EAB9013CCA774064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 2d0d374b5b0662c108cfd3b2f601f5e292c801d24bec721253986552a59caf3f
MD5 27804437367cfbc2c0c7003f007caf6b
SHA1 9f52d074919413f6d5cb05719fd1932259f32186
SHA512 904ee27d25af83f48d3402a7373d2aeb673a372912a09ce455ffa1cdcfe431011edf0baceb4ceb0674aee0a1b450fbd5235f8dfca1029f1c20884747b1b5f984
SSDEEP 12288:eyziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1285523DA118964B1EABD003D86394824B1943E3C9B1628F7A1947D3ED339FDBDF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7cd3231971bdcf83f9ce54eb30dddbf34348afb3153843d713bfc2f9543a458e
MD5 daab6d1f71223216c7095cf50deaee88
SHA1 518d01fcfff89a979c93e3e1a45c1a2f74165a22
SHA512 9076619e483bd75831076ea514fc6cbff88d58858a9dd42fcbec222f4733437a7ee7e39b8bf1265abb0b4c2cf1001503a29e0b6f8f1f70f358264c85e3760cae
SSDEEP 24576:EQ9MxZKdcz9dw3E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EVKZELNiXicJFFRGNzj3
TLSH
T168558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 653d1c8a14e8b09a12862ae894eeadcc84d1f4fbb404e7382f7b25f8eca30d6d
MD5 54894ae6e41a99de3eacec9258f279bc
SHA1 3cd9ba7686e5bf44aea1afd98ea67136cf9fd456
SHA512 4812869b6672512190cfc58d16b56527bce9d1d07e484f944a6487e0a862abd51580b8aed4a538fc24be85578272d936a6edd3eb7ca2565694dd8148deb066fd
SSDEEP 24576:vyocDApt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qocDAptLNiXicJFFRGNzj3
TLSH
T1FE65E05FB76D40A2E176813C89858204E7B3B4345B6257CB6191C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fc3d384c74cb92242433ce725482f861f699c6fc856584f46ee8b651eead99bd
MD5 8e4bc00b8593f35ec10693cce11d5daf
SHA1 09ba8bc19c161fec3fb65bcf14bea5ae61e9b9a0
SHA512 36aed262f6674146074b788b1476adc912c6b86b784b2cba3dfd18cf1dba38083bf82f8f18a0afc5b4d8735d51c0cf9ec6143399e1558c42a933900bd88b86a7
SSDEEP 49152:MWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKtLNiXicJFFRGNzj3:G0zuNIj7wRGpj3
TLSH
T154A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3825d195537ad56735e23ae0fb8c7254b5c52a003dac45c9f94098facd72cf7e
MD5 1609798344fdac3db5f05819f0685146
SHA1 c0438e173a5b5f6d712a2a691b22c8009f546d04
SHA512 a350e42b9aa607b2a5cee75a17e5fd17b55654f12346ad4135515e3eb362772e092559178c5707493d3702558bd71a3028442d923feed78474766ae8c2314229
SSDEEP 24576:21QT7EcpfxR+N5AWAz3ooiYzjMqbj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bTDxR+N5YzTBjMCLNiXicJFFRGNzj3
TLSH
T15855B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-417-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/756-303-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/756-309-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/756-311-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1100-253-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1100-317-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1120-414-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1120-334-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1120-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1204-455-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1204-331-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1604-441-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-427-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-459-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-420-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-422-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-425-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-462-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-461-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-464-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-442-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-443-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-463-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-424-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-423-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-426-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-430-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-444-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-445-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-446-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-447-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-448-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-450-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-451-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-433-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-449-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-432-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-439-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-421-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-435-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-436-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-458-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-438-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-440-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-434-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-431-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-437-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-428-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1604-429-0x000001C5A0940000-0x000001C5A0950000-memory.dmp

Download

memory/1652-326-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1652-272-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/1652-277-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/1652-271-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2140-244-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2140-75-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2140-81-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2140-86-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2164-288-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2164-339-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2632-327-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2632-454-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3120-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3120-242-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3120-41-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3120-47-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3420-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3420-239-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3752-69-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3752-71-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3752-87-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3752-63-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3752-83-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3772-23-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3772-26-0x00007FFB5ACF0000-0x00007FFB5AFB9000-memory.dmp

Download

memory/3772-241-0x00007FFB5ACF0000-0x00007FFB5AFB9000-memory.dmp

Download

memory/3772-240-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3772-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3772-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4112-36-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4112-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4112-8-0x0000000140000000-0x00000001403DE000-memory.dmp

Download

memory/4112-6-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4112-9-0x00007FFB5ACF0000-0x00007FFB5AFB9000-memory.dmp

Download

memory/4112-216-0x00007FFB5ACF0000-0x00007FFB5AFB9000-memory.dmp

Download

memory/4112-85-0x0000000140000000-0x00000001403DE000-memory.dmp

Download

memory/4168-323-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4168-453-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4228-395-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4228-411-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4228-340-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4228-418-0x000000000CD70000-0x000000000CD78000-memory.dmp

Download

memory/4228-457-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4228-379-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4304-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4304-319-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4360-335-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4360-456-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4636-291-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4636-297-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4636-299-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4636-413-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4656-257-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4656-322-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4656-258-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4656-264-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4720-282-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4720-330-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4764-452-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4764-314-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4876-94-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4876-35-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5024-243-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5024-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5024-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5024-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download