4911d55d569975e7ba64b1b6075668ed3875ba67b8bd54d85f4cd49cd313204c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_ebe958b940e7dd1defbda07cc9308f2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.8MB
Sample260916-s8k4jsbe79
SHA256 4911d55d569975e7ba64b1b6075668ed3875ba67b8bd54d85f4cd49cd313204c
MD5 ebe958b940e7dd1defbda07cc9308f2b
SHA1 6a6e8314f4fc00ae641b8f5824c146eaa7212fb4
SHA512 e097870b6a9517b919fcb40e2b036e775c3ce577bf54057d93dcfb0545a008c72cebbe14d944560640250c9a47ebe428bdd0ad20769628f133424c43b0167efa
SSDEEP 24576:tBYGb8akt3A6nzSpvyxknw4FYnshx8OfVe247:UI8FA6Px4x8EVep
TLSH
T1E995D019A7E900F8E1B7E674C9A35A02E77B7C054670D74F03E8917B2F636509E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4296	alg.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
2136	elevation_service.exe
3496	fxssvc.exe
4572	elevation_service.exe
4464	maintenanceservice.exe
1760	OSE.EXE
4004	msdtc.exe
4188	PerceptionSimulationService.exe
3512	perfhost.exe
3052	locator.exe
1208	SensorDataService.exe
396	snmptrap.exe
1176	spectrum.exe
1672	ssh-agent.exe
4428	TieringEngineService.exe
964	AgentService.exe
4180	vds.exe
2916	vssvc.exe
3212	wbengine.exe
4416	WmiApSrv.exe
4488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d1aeadad60f3a3fa.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-16_ebe958b940e7dd1defbda07cc9308f2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-16_ebe958b940e7dd1defbda07cc9308f2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-16_ebe958b940e7dd1defbda07cc9308f2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-16_ebe958b940e7dd1defbda07cc9308f2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-16_ebe958b940e7dd1defbda07cc9308f2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\UnlockSwitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050dc96f7f245dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004102bdf7f245dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c0660f7f245dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8c5e0f7f245dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020f0a9f7f245dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fca19bf7f245dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000db68ff7f245dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
2136	elevation_service.exe
2136	elevation_service.exe
2136	elevation_service.exe
2136	elevation_service.exe
2136	elevation_service.exe
2136	elevation_service.exe
2136	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3192	2026-09-16_ebe958b940e7dd1defbda07cc9308f2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	3496	fxssvc.exe
Token: SeDebugPrivilege	4452	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2136	elevation_service.exe
Token: SeRestorePrivilege	4428	TieringEngineService.exe
Token: SeManageVolumePrivilege	4428	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	964	AgentService.exe
Token: SeBackupPrivilege	2916	vssvc.exe
Token: SeRestorePrivilege	2916	vssvc.exe
Token: SeAuditPrivilege	2916	vssvc.exe
Token: SeBackupPrivilege	3212	wbengine.exe
Token: SeRestorePrivilege	3212	wbengine.exe
Token: SeSecurityPrivilege	3212	wbengine.exe
Token: 33	4488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeDebugPrivilege	2136	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4012	4488	SearchIndexer.exe	118
PID 4488 wrote to memory of 4124	4488	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-16_ebe958b940e7dd1defbda07cc9308f2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_ebe958b940e7dd1defbda07cc9308f2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4572

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1760

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4004

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4188

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3512

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1208

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:396

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1176

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2768

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4180

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4012
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 779630c1a5f1a008971c346e2b40b39ff6c609bebd23a7c04676804a37b6ff51
MD5 7a42523b0a946a8ee1d8851fc915bf6a
SHA1 4c06bef4eb473d54a92280402b995499208e4381
SHA512 3d5ed60395ba71d36229688092b27ab324cfe2129a924b9f26a4bc65cd6e754bde50edb32ef487b755c23f82d364a5ba36af9a65064f9740b4011302bce8df8e
SSDEEP 49152:mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVx4x8EVep:Y3q6HjBmix8EVy
TLSH
T190D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 0c1bfe704e618a32f4593a55e8d2f9b7c9e19a49062abec7a5dd5b3fb79bbe55
MD5 7f0ddbf8fdd4124133546a0734c3ed2e
SHA1 52142bfea3125f11187cdd1d2b04beb4f50fe49a
SHA512 968ab3402b4b2829c00a8b019261200a93a019a984c0d0c86bd10b672a564e1e6effdf83000f68963d291049ab069edf7722a9ec06cee09198b9bea3f4a7c0d7
SSDEEP 12288:S1XLsswWkxy2lRq2czAv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:4XYfDtczAvyxknw4FYnshx8OfVe247
TLSH
T14F75F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ec58981080e8669c79d20d2832e81d47557300a49000bbcef9ed25d89a9a86ca
MD5 2378c5cfd2f05434deebe30218fdbc3d
SHA1 221285b53bfcf42b513e6694fe6fc12813261f63
SHA512 3f4555f055783b3023219cdb29c9c1d0a2578964d2ed0342bc376e959d76cedaf6bb844e93b242339dd7c7381f07ead4a25237953f1a82a449446e4c944c01f1
SSDEEP 24576:J0Le5ji0hmxFrMCyxknw4FYnshx8OfVe247:JPji0ArQx4x8EVep
TLSH
T17095AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 39916ea57cf1e1986df95f88ea53f4d1cf14687fb19f5d75af2308414c344cbe
MD5 75f9fd0ade536da245eca1a8dbd6d451
SHA1 a5ad45159c7af4c36354d8bc3f02f956294542d4
SHA512 a49c9825bd66a7fc0386553340fe6fb7b0293f37f2050cacc84000ec5397cd7a0cd429e22836291d21760a4bb10d8b4cb8583c41aea3a271f8e168e48919980a
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuMyxknw4FYnshx8OfVe247:E/ezSC6vUzPvxHjy0x4x8EVep
TLSH
T141756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b4e67dfc1198c09e80e0f495871086e6666e3d4214bc18efe6849cd357e60d3e
MD5 e72a297ece260f927d164235e6ff993b
SHA1 f2fd5b1a90d0c695288d9df744fe4315b183d746
SHA512 dab9c9fe2d583fc6f8eec5aebdf03ffc528837986ee6e9374efc58f81f82bb753cc4d6af988fe7718af076d18b3d5074d0ff0586f97da1d5443455f9a0219949
SSDEEP 24576:mVbqPb88hv/l+6zyxknw4FYnshx8OfVe247:mVO88hXl+Rx4x8EVep
TLSH
T12C559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 805e3957e2ed153f10141dd6084851a77bc33c29ce6b08d3229d6555717b4a9a
MD5 bfa58aafeff5a6134a890e21732eed84
SHA1 dfb3df4710cd71c43c2cf0dfb262aabac36954e5
SHA512 1b9ab36d1c5fdc516a1a6b26cbc36ed9956d2f140ffaf2723f04fd9bc25fcd8c6d09a5905512d40395fbd74b6323fb19fbe69daec74b71fea5584d894985659a
SSDEEP 12288:BN2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BN2yxknw4FYnshx8OfVe247
TLSH
T19A65237CA7DDA4E1FA5E14331A7572623616F9A0DA74C11BC778B14EE0F0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 85d60ccc8fde71624af7e19fff71306ed8479cfdc4a82cc134749489d8d49c48
MD5 64b9c22e73849c572539184882f706e9
SHA1 2284bc49f308ba2521cc94c0512e6a5778b9a01d
SHA512 a02c7114a9d062479b047307cf59ee11363a2470e0d1bf453433754f6979bd4e855716a08b6ca93466f6aab822c21a8c6ca8d33e4f9e2075ee60e0c2ddf7489c
SSDEEP 12288:leBNUbTVO86U7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lJIU7yxknw4FYnshx8OfVe247
TLSH
T1B975CF7BEE28FCD2C27E4DB95B918600A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 82783002a0ed02ca7c0bd434267eac7a1153911a559503e73115a06aa7cbc681
MD5 3d5ac64252ba1da80e0a6872ed17ebcd
SHA1 68e1f64bb8fae943dfccfdfb8311cdb285574e76
SHA512 3bec43774735a59f3c92fa1c43a36d4e78d552b8c9f7bb70322100a63a8de12c40268d7a78bd42ee0a0faec894674574a610c853db6be8e8ebff351cf2324771
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:SQvGAdlCEL8c/yRNw5C3ix8EVy
TLSH
T124267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 87795cb146d419e9876d5489e5474e28e724f5a0fc9e82a00e596df93e721d22
MD5 f6e106f719ced8b8da3d5bc534f9f11f
SHA1 8c0da1a1ee1abed43ee306ea70ec3c26c1196de5
SHA512 ef7aaa82437d6d8b0000a8e6d33c687d24bcb731ed61ad1a7fe89dd09a590ef58a2c8649b647e0e83ce84e1e43185d4b060bff80f1f845519d88b4fd6a724363
SSDEEP 12288:0AwSfxL/2Dc3LDLLmt0LDQewsAjV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:J6ewsAjVyxknw4FYnshx8OfVe247
TLSH
T1B585E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8ead15ecf692d996e2e71b22f93beeb116dbe72d98f666cf6bbfbb20d0c0f8d0
MD5 ac0cd459587bed8f1a0902ffe5ad6fa2
SHA1 89bfaf26a12dc81b2788a8bc1965080941166dd9
SHA512 b9722289d769d091bb37f73f43e513283aa9bc20dd3e4dbca1ba4ba54600ecc2e9fc56d21fa51e96cc1eb0becfddb5ff46aac7a18318a6d27c2dd70df602b8ba
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHF:OUEtQevvqc2W1cpV2EI32
TLSH
T1A7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a451c4f4f11a5b7c3c576351d00ccd093bea9a0fdff318adb2aeaae1b4a46f44
MD5 49f99ebd16e381200b37860942361058
SHA1 adba9e2c322012d258e182ea051ea6fbc55ec1ab
SHA512 304632a29e2a999424c6f1a05c13948a1bddba213d683c9537fc5b269ed875f63144e414f8357c80c1d2389edb1257b99d68e1c13b7aaf37e187fb33d00920b3
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zAx4x8EVep:0oqtVjnm7ix8EVy
TLSH
T17ED58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e9f5c1f72f73b61697bdcdeae85165aee53e4a1ad163297db1ec182e002e89c2
MD5 448d7f19f6189b1679c85518d6939ffd
SHA1 89f911c7170781f942c632b41fe31366ae98c010
SHA512 6796e4ab2119b4315376611057573e22666ef1893b23a532f5c1565144512a07caf97ec51abf9a5b8ac4154318d3d13bd5ae1e2849c19b2135b432f2d5122d62
SSDEEP 24576:7AhGLJIFoiwtA5l7S534yxknw4FYnshx8OfVe247:7AMyFoiq5Lx4x8EVep
TLSH
T13F35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 601d3b7042fdbd9a9a69f130e6f6f715ce6165b2b9d929ae0e010edbbaa3f142
MD5 6381dd32a16c75627c116591fec05bb0
SHA1 234ab51de1a981ee006520d8e48bf1353d48b1ac
SHA512 5d7dbe270b27b36c81a76cecb86708576e0254851fe88552d4d1a4851ed13bb79d5a11da52c460789d0c83d01632a4b311c8e3f2c5ceef5fee6834563f0068fc
SSDEEP 12288:Smw5HEjsChNoBFgl0WDm+Cs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:LwuFOWRyxknw4FYnshx8OfVe247
TLSH
T1AE75F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 38189603730413ba94bca0cd2c2f969bdfc33ab5ee8c5a3d1e3c635024809981
MD5 1bc992d67fb5255dea9373e255562dfe
SHA1 36a94dc9b22a6eae5a455b4493e1276205a91f24
SHA512 351eed6422449b37ab36d82de1d70e2241c176668dd8d56d5d84b2a23f567c503df8538286c5acc3563fbf512f564d889f51a3b7d2a6c9eaf993aae08f6b7e78
SSDEEP 12288:1FZ1Iyl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XZuKyxknw4FYnshx8OfVe247
TLSH
T1C96512AC33E860F1E1A7113A89F15205A77274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 435cde9dcf8e6fc302fe7216a0b004947e7dc4cf24887deaa2b389a4cea0ea4a
MD5 98c0ecb4474d5bcc48c03dab7f1e6b78
SHA1 56ddc370626dd5d9bf5e321aaa0676aff3a92906
SHA512 e7e781b3281340bce78f80b7dc8f0bbb90fca82d70f2166c8a9744bdfd7af97d9cf20e01e30542f5a04815336dd21130cb76223250966720f9525b9d6d4ac98b
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:FQRQyi36YOcPQLvw2gAf+PN3Cix8EVy
TLSH
T1BC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4211810a852be5d4e7eaa7742506a4fa80e9407d5d50ad136b87aeeb561a6b6
MD5 72dbd6b5fc285c8deec278c784ebd9fa
SHA1 e61b70e4f9f1de7d009f1ee470d0b46c352a253f
SHA512 797e96b1d7788be062111c91150a5ad95e30fc9cedc0a9aff24e985027b53c8c4bb165c2e7b52b419a9cab58cf0f5398eecb9aa3886f4af36efc01f45d1b4c33
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:QQRQyi36YOcPQLvw2gAf+PN3Cix8EVy
TLSH
T13B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cba805da6e7c611237e57ca06cba7f88e080599d933a1b3e6372d43b798d892a
MD5 249a91c556df24d1ed8a4213c6248e42
SHA1 7626d2ef2684649acf89b6b6eb0bb54fec1bc1f2
SHA512 9e2d101a9a79338fdde2e6c8b63b29469d27b028452285ec93455165f60bfc2f01ae96cf6e8af74d4d45c26f2518a953a10b2c9ffe1821e0f8093fcb1d658160
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL06yxknw4FYnshx8Z:K68Qg55nhheWu7PNU3/Qx4x8EVep
TLSH
T1F3B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7b0554126eab26ae861841951b6bda5cc12307fbc6d51248825e73fe13963276
MD5 e22a451d5aefa7bd8659e1978f0d6e63
SHA1 55ccc6f11c4f0ecdddc0724312d637e9c47ea6c0
SHA512 7d1f758dbe32c561d077d4b771acea724e48e27d16a7237291ef0dc541642ff19793bfb2b251f0c58d2e7a950f039aa8352dfd5b71de409e0030534c538220c6
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:py5112gYy5azzVvL69nLKnhZpix8EVy
TLSH
T1E0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 98fc735e277b5c0bae90a261b2d59bab0cfb1a1d6c740d0004b1b8f5fc542832
MD5 66f7712ae926e743257958d7e7f0ff7a
SHA1 41d6387875d410006b55b4db30da16ab4d1847c9
SHA512 967156320cdce9dfd2fcdbb6ff44a02d2865596da600d1e194ea0e30f06da7cb96f7fcbb72e41a68d53fd37d5547a21d6d763645610654ba6af4a21c9ec1cb69
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKx4x8EVep:du6JmVxd2dKix8EVy
TLSH
T143D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 705bff595197a1496888a049888a826306b420121f9dbf89469114129a5b92db
MD5 7cbbe2632196848b01ef994bb81f0f2d
SHA1 8745c8ef2d8a8d67206003f8bc19864c29f9e0c0
SHA512 880e642550dde259ddbec972938555bdf23fff6cd1354349c78dd29c78032e2af1e6bce5f7dd83063ad78e431421fb88e1ade6df6f842a7f94e31abac4f673c6
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4x+x4x8EVep:VmifPbR7ix8EVy
TLSH
T1CFB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 43585409efab6bd1b304cc029695c0215551d86666d659fb15263ee35bef37b4
MD5 75c76519c63f5b36faaaed7c6bb1a25f
SHA1 8dfe4ddacba41841b1b95776bb87c26f7a4c6fbf
SHA512 d98f375d691318d2b3c278a6c381f4edec05cbaa967cf87583fdd4ee5978ca897ca51bacb4389cc0edef319f1edfe080d7d1976ed8b3dbc786f491b84913dfcf
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqlx4x8EVep:f5dKTi61lix8EVy
TLSH
T14BC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 65b9b1756f49b1d851e81de5780434a5547dedfb3aff1d55838186ac1bca2889
MD5 6733fea7ae5c8a443c97ab9ddffca306
SHA1 09db966c1f39d7bcb541d71ad400c1f0852d1900
SHA512 1f5dbc29e1b0464a1003198faa14cb8f1a798949bc94ea2e4f0fbd6e325c16b28d133db137258932ff8c3fb30d88a425a199a2656e855eb43dae177f178e9462
SSDEEP 49152:5htSn8EApI0figngiDn0AP5wax4x8EVep:IX2iyphvix8EVy
TLSH
T17095BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 90009f1218ddd466e22e6097c1aaa0abb6f4519c70b123f3e46a26f764d10377
MD5 7321e5b8661f174ffb0ccf2ac511aafa
SHA1 6d6bc4725364eb46ac95a2e5b0ba73c6471cf9d7
SHA512 39657d87e11168e41cde2eba59a4ae9300385d2d4390bd967384fec489c3eb814af63181f78d3399e0f28f3a6c562233e5811d01667e76f34452d8f91b103ecf
SSDEEP 12288:7e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7eyxknw4FYnshx8OfVe247
TLSH
T1C565237CBBDEA5E2F50D11734A7162627609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 eee89da07c00e6dee0b00d3715dbe3b323ee76ff3375aaf8385cddfdb838865e
MD5 064c71b7f10c8820106ed0b8cd4f45a9
SHA1 e40422cc78850f80f45961f6219804b8cb638a3e
SHA512 ef81d69d223f01fcd33b9ac0d7f62b910cdb682edbbbfad072e01a46b65441d4ac88bee6b8ed0d7df19e35a143ceafe5d941da9e2b1f05706cbcddf7c480cf67
SSDEEP 12288:IJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IJyxknw4FYnshx8OfVe247
TLSH
T16365237CBBDE95E2F50D11734B7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 25c417273e84fd80f138f9dfc3310c0a4933fdb7d4d930935255909d96caabe0
MD5 710a65459ff788ac38f979a72eeda849
SHA1 040c30d73d4922d7dd01528f53df24aa831cd4cd
SHA512 6984fc40278f88cef7b4bdcfea5dc4ca60e7d824fdca242c30d1d2ec87f99ceeee87ebad9bf5859f888c56285199d5dc0e661ea2be5325ee4946e5931e0546c1
SSDEEP 12288:aj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ajyxknw4FYnshx8OfVe247
TLSH
T16C65237CBBDEA5D2F54D11734B7263626609B1A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 16c1c3a2897c4be7298ce131d39817cea8ac6a6d680689777f8686e9bd6ab60c
MD5 f0904a6b2f274435bb6d5ad985dcf0ec
SHA1 6ae7ca4f0da2d88c80cce45badfe811406257720
SHA512 b8f9661ab576463c87a066ffb55d749cc513ef6136f94d2bea4a5136177f49d14b1fb5b09b6224a5dca09c36c2818e687269f7936a9bbc33209e1f6a3858f59d
SSDEEP 12288:DVY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iyxknw4FYnshx8OfVe247
TLSH
T1E865236C77EE50D1E85A51738A726222B365B8E5E731C35FCB24710EE9F0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 252e6b73559ad88ce1c48698fde266f52fd5e4ea2982e3a59bdd705cf67e7e8a
MD5 e33b563333ce816495488799290fdd05
SHA1 2aac943fabad3a77f354abc2faddedf6e0ebe93e
SHA512 efc880ec869c9eb544b394e42c1ef6834d8419eb0eb048973da12752bf55fdb488c691dde838e9d2438e8207cc0754b3d7a686b69763e6fe721eb91b86461ea2
SSDEEP 12288:Sw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Swyxknw4FYnshx8OfVe247
TLSH
T16765237CBBDEA5D2F50D11734B7263626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 03af69f49b6c46eaf4b365cea620edfb813cfed98773879bb5cecfb0b4becb8e
MD5 37f62a7fe9802851fb4c8c30192cf59f
SHA1 732f4d852b42804670e4d02f217e5e0f5e09ec1f
SHA512 80f56a8feb2102e8ccca4c9753ce83117837ff221404f4e960b33695037c71984bcb182b6ef7ac7a58e7f46b710c1cb488dfe7e357715c3a7fec82f9158803d0
SSDEEP 12288:xd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xdyxknw4FYnshx8OfVe247
TLSH
T10865237CBBDE95E2F50D11734B7172626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 268c99fc935d4ebeed8014ba18ec34a2bb8721485f387f072393ab6e85afc7f4
MD5 2e4a14aef485bbf4967e40735b34c18a
SHA1 9ad391284d4d4528de838ab7e49f0fca89c9db29
SHA512 653524d65804235e53fea91687f24a8c3666e73e79a82782f45b89fe001c2be9120903b47ab9a4505c8a4e889c615110049f7419d95ea89d1ad48e2d6858f4db
SSDEEP 12288:KB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KByxknw4FYnshx8OfVe247
TLSH
T14D65237CBBDA95D2F50D01734B7173626609B5A5EAB5811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 d1ab7b2d641fcbf6e2dd611671d6507aca7f9d6a81a8a5a4ac6f1551eb676e4a
MD5 eae76e8627048c066bdd6172c2b8e3fa
SHA1 aa659ca4161eec58277378dc43567959fb0ec46a
SHA512 b0d169ca6e57cae8a197e03fb7804fee2c9cbe2597acd48b608920b5aa577910d0f6c0ccbf4834ae977e6b646c7d7958d4a7f466ca526143e25c37c859f9ea98
SSDEEP 12288:AiZwbZzzFEoS2cPvyp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DZMdzFVSOpyxknw4FYnshx8OfVe247
TLSH
T1ED7502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 52965c8143b1bb1f1e7e8fcdb7f0b27afc818cad8f740d4b7e72d095d4a27bff
MD5 b9f9fbcd7e1990b792aba246b61a24ab
SHA1 2014ccaee1f455088f3cc957dcfd4b10d28af33d
SHA512 64d7f9ef66a16d8f50447a32d17f23e37f4f61b9b6f8f31302bfd8bc91012b4a64958d7bc071e0332b3b4cb63dfb753200a9dd0c915a25929efd505f3c36b37b
SSDEEP 12288:Ka+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Kayxknw4FYnshx8OfVe247
TLSH
T15965237CBBDEA5D2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 53c2875dcea6312e55d33a30110f529a92817638561a73d93a1dd2723909e0c0
MD5 8831718cea238375097d463a005a5416
SHA1 86ff7817f809a1f5001a493ed83546f3e24dcea1
SHA512 a0474f89d39e1ef0c6d29121c20e7f55cebce252efd6f1c754782a6c0b35374357836437d49e34c192e95885618eda9dad1a27281cf4b6e5748cce1257ca288e
SSDEEP 12288:dG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dGyxknw4FYnshx8OfVe247
TLSH
T1FD65237CBBDE95E2F50D11734B7163626609B6A5EA71821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6a044417956dceb0d85bba816ee947bfb7adbeec96c663ece988bf73c79efa90
MD5 e39d915ab6cbf06c9e2e97d8a9fbc3e2
SHA1 29783be85c9c05b0d8c513a0579e2889ab5169a2
SHA512 41cd0e334e1319914f0660aaad85fb05f2c58ff59ddb9e9d7d79687cb5950aba40e1ad0136f0601e47f88a6cb3dcf2aee6a7a3554592458e4a6bc5efd73a3522
SSDEEP 12288:TyPz5L8l+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ezylyxknw4FYnshx8OfVe247
TLSH
T1E475125B73E530F5D13A423689621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 930d921f81287729dac21291faebbe860166d46c408f2fb13b7602ee14d6869c
MD5 e9f38eb2723b81d3dfa7d73c16581215
SHA1 a3f870491c6b05e126b8b7feb00da2fa9bf7d546
SHA512 9ba28348d4df32a99a7948fdce41ead5580019dd44b0d18a08fc3676a9dc858b1b8e7ca58320c621cedbb87e8a708f0305dff1c69d41d2eac42d2099e8cc9a59
SSDEEP 12288:2a+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2ayxknw4FYnshx8OfVe247
TLSH
T14965237CBBDEA4D2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 6a877ca2604db7201d9040cf4ec3e5006968f8af0dc60a6e5d2f8755aeda3b77
MD5 573f37eb39c4d9b75e8b342e51dc413a
SHA1 df73b12d0993bcec6e5e7aea09866713adab7b61
SHA512 4ae663a0fbc9d4f6b6e87cb4dacc9e6309e7eb65c5c0c288c286e688bdab734e2685e3c295e09615262cf61083574f8392174f9b8ba521e7c264c4f1de635e40
SSDEEP 12288:8a+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8ayxknw4FYnshx8OfVe247
TLSH
T12965237CBBDEA4E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 6214f36c698a4ad9bdfe38a515437676bddaae2dd23758778582de4b4e5f2b71
MD5 b24ad7965e771b58aae4293073854f10
SHA1 76e38c2384cbf10a5f13c560b3cc72df96cfa19f
SHA512 2291507d60914833751d8fe68d73fa7e255ce9fb1c88880a1642e631196dc1925667f34c0f0b2fb992d9710020dc32688cf8b16bc071cf59b2e332b935afca4b
SSDEEP 12288:PyPz5L8l+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:izylyxknw4FYnshx8OfVe247
TLSH
T13675125B73E530F5D13A423689621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 db863504da306b47cbe105f6380b56c545ee75f56012eceda59b3b9eb170ecbf
MD5 d20041cf4dd47aa65eb1984e0cef3cbd
SHA1 1f631d1d69859f4eed2d46b74771a361b84d6416
SHA512 901dc6c97122a558bed9161ad6a182c3da341bafd4d82a206b96566e7ed39e48ed2a3d85f4a9c06a420ff3e9b72524872cd0ad6748f23537644a75bd2cb9179a
SSDEEP 24576:MTGaLl3z0zDTyxknw4FYnshx8OfVe247:MTFLljnx4x8EVep
TLSH
T1657501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 a004c38336d9be03e64b93169b9f1519bfc89f19472d9893723007ed3f476782
MD5 72d75de6349ad9615b36f3ec5de610e3
SHA1 2c192d192498c822eb6a4d21b3034d4f2d659ca3
SHA512 578fcc2f3d31293553cb88c1770d904fe0fe7cae63e0ac1f6bfe79467b599865033dd3a64b3e4a9caaf51b29151f05578d2e29508da9243b9b18452671a769a3
SSDEEP 24576:/3nd9CHKy7GZXyxknw4FYnshx8OfVe247:Pnd9CHKyaYx4x8EVep
TLSH
T1E995CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 6b8fd1acbf9fe4e61bd85c7d8426a5f56b75d5c429e5a87ea827d7755e1860d7
MD5 08f7c3df278ecded98d9c6611da44068
SHA1 8f0be477a04df32c48c679115167c435c66cacf5
SHA512 68a3ee1334921c9278fd1d5084156881afd63f9ffa53ca8619ee8f0c990e2bd00308e65bc01e596715125dc2d8bf44c15ebe5b69c25addbd2390acb488931087
SSDEEP 12288:YD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YDyxknw4FYnshx8OfVe247
TLSH
T12C65237CBBDEA5D2F50D11734B7263626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 8a2cf51b47da75a06edcd401479e862a92e2db940575f99c708c4952f1d371a6
MD5 22daba8f6bc956d42215f9252c994df5
SHA1 ff4dc49042a6cdd5baf7c757f44a02ddba6762c9
SHA512 979a02a68f331ca67cce6eed2b6616cbf7d1048a841260a78980b77ffd8473d909538f1480b9adc7a991fb9dc428c7578d8ce5ab6b75f16c62e1b9889004f48f
SSDEEP 12288:2F+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2Fyxknw4FYnshx8OfVe247
TLSH
T1D965237CBBDE95E2F50D11734A7163627609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 0e4a667566bdc72446d12e505fe330085897bbffd86369cbad0245e9aa98d379
MD5 bcd904faecde40f9762f95dac91a3e58
SHA1 e293891ccd7fbf4a8521f585fde12b32b15140e6
SHA512 f59afe2c56c2b9425dc775b1f720ddc7756201ffdfa1b4c7f23d95fd2b4f55e8af9d87014ddfda95fa060961f8e6535bf8100c437e1b1d8dfd73509841ee9af9
SSDEEP 12288:Lk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Lkyxknw4FYnshx8OfVe247
TLSH
T1E36523BCBBDE95E2E50D10734B7163626509B5E5EAB1811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 aa319f0895ef4e72f80d827d28974e9ab623e3887e3bf5ca5edc9851a5c5db06
MD5 6f2643d6b8ab34b073987511ed028f08
SHA1 df66f9af0a4ac031069001c68c7aa401ce479553
SHA512 6afce44137467e61866f9b55fd84edf31e90c51c5b59b40956502a20ff467e8a744fb80ad3dc882552f630d38a2300bb2e85f3428276d12aa2a6507999c670b4
SSDEEP 12288:v+sfK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Kyxknw4FYnshx8OfVe247
TLSH
T1C675F028E29802E4D06E2236CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 6b56ffe6356f0ae6ad00d2f47efea0dba4a89d8971ebd33eedf0ac904da548f1
MD5 d2219f6ee1f23542677c4888bf9c29fd
SHA1 eb6c5365a1729fa2e0980822c2cc5f0cc8e282d7
SHA512 54991b28d413a60a167cef06d1c0ed12638351597bcd22eaf2b2d2aa4adc8a444450b929375f68696908cd926e4cbcfee40ec509bd99d93c67cac9d70c5f812b
SSDEEP 12288:C94+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CSyxknw4FYnshx8OfVe247
TLSH
T12665237CA7DDA992F56D15730A31A231361AB2B4DF70C14BD768B11EE4B0CA0E83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 50b0d2ed4a60b9783f5a7c1a7bbd8ffc3bb0030302f79e8fcbf2e180d89c29e8
MD5 baa173921a37fb21013de62d5146c97d
SHA1 270dbd142e82fd6b010f8bcbc2b75c7de781a904
SHA512 f1db11bd6592c687d9331f721324bd70445c924f8cf6a8e4b9615e8ea8c656182ce06ad9ac6486e6b1376e6500d15bfb0d409c7ce18f0b31da44896a1534796f
SSDEEP 49152:9a0h2GEkuAe73q3pp46zwwQ7x4x8EVep:9a0hNYG4JwMix8EVy
TLSH
T1E885AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1190853D7F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 c7d837078fe3d2edcbdd179b077561209e8dde1b29b92febf37913b3749bfebf
MD5 a77355190f8cac796b2703ac8b40c2dc
SHA1 30c090d1b54f755ccd229183a6acb8a7abd2b9c9
SHA512 e5c10d48692c9faa33796abcd52fe6178b391dc87d8c194ae88b7ed96bf9211601e58fe3395caa2ae16ab1d2aabd6325300dc47c94f7d4447707a497a42da392
SSDEEP 12288:2hbHjfXA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2hbHjPAyxknw4FYnshx8OfVe247
TLSH
T1CD65117C27EC20D1F175A17A86A28206D331B865173193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 311424b13187eb99af1f4ace80598b5d4e11e583e64231e0afb59928fa2c1676
MD5 f7132bca99041e06455f58ea18ca6890
SHA1 6c32646a0ac79d13857984a22991298a46230840
SHA512 aa13b07b8d18f4981e0dacd692b0311be120c1702a5ceaeaaede3f4ada4adf37ba6621bb1294dfb5f99a416cf39ac15d22246750dece3dec84db7b2abaa87e02
SSDEEP 24576:j3YgnJcRTk4yti+R5dBR/Iyxknw4FYnshx8OfVe247:jIgnaTk46pBR/rx4x8EVep
TLSH
T10545BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 734a62d37dbc2c42b5f44588243f661bb9d5da0945096541169836c0bcf6635c
MD5 f611eebf8e59216c9ced0adbb3d2a462
SHA1 aba9a4baabeb8ab08cbdced084cd8e9e070708ad
SHA512 e6ffccb29d85ac549da4d4c403293f8b93ed1b084a360151b728a17e79cdbef3573605cd6c383a7ba12c67493a20e4ce896451d51ac3c7ef227ec7c6ce3ca4ee
SSDEEP 12288:JR4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JGyxknw4FYnshx8OfVe247
TLSH
T1476523BC67DEA4D2E55D15730A7262263605B2A0EB7182DBC77DB11EF1B0CE0A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 51b573fb4ae1039fac744e80fd00126e850eda820311c5dd65cedecb52026ce1
MD5 295467a9585ccccc259f1496fb80a924
SHA1 cfc1e23edaffd40a54d89b4a912cc11684549b7b
SHA512 ca77e80074174a826e5f2e31a7f251045a63dad60fafdb80d5e14b17983c848d00e60ae8f26c307aab7b7d30652c7b15f928c3e9a456225de1536c11b1bb31f4
SSDEEP 12288:cOb6A4LWOsvAYFT64+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BCL3UTryxknw4FYnshx8OfVe247
TLSH
T1B7850158F7E400F5E86B813DC9729612E272B49D0774E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f379274a71fd614471605a9ae1c955c5ac9de452ec5142cc272ce512870fbda0
MD5 a1f9e690e067084a137ff7471daf97a9
SHA1 24aee0eb6201964f7a26e312dbfc617fa03c1f3d
SHA512 f4d092784600104d96ba735239fe47641888887e135f763c37959516839d9185188c968d2880d25b014ae3916e969398da0cabd66d8e0fc95eec02b281f7a61b
SSDEEP 12288:epFtkO+4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZOfyxknw4FYnshx8OfVe247
TLSH
T1CE65022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1518dc054a2d906c6bcfb75a5379cf1fa25e52e5c9818918dfee57d97faf5007
MD5 b4ad29c566fc19603449ac5b0fdebd35
SHA1 5d5b1b172b4fa8a7435b55f5e5f7383239ba08b1
SHA512 a9eb47c1fc1b6c9cc984d8f5dd4594c16517c2d854ce2b54c0aca91104f79b4d02618e74ca1ff5df9eb27724e30d27a999cb39eda7f32e1d2a64f714cbc3ac80
SSDEEP 24576:Z7NM9YqZqmWMUkPjZM48Mv6bEhsCyxknw4FYnshx8OfVe247:Z7cBWMpPjN8DbEhYx4x8EVep
TLSH
T1F9659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 fbe16af8f036dc9f66db03e635bfcec4877203f099f6e9101e0d1582f8069a5c
MD5 020cae3d0688d6e471a40f55ef7ab5d0
SHA1 592c3304c95e5d11d46e92e5b66b8004ae5dd768
SHA512 557f859db50afdb71757f012bff7af3b5ee0669144aea4d10aaf61ed14b445d36c330ad2e0bd905abbdff4da19e06024d3c3d7289df6d242b79c666c0fc16061
SSDEEP 24576:uW6BApg2YuyuNDYTabvcdvNYf8km1Uyxknw4FYnshx8OfVe247:uF2YuHNETovAvNYf8kmdx4x8EVep
TLSH
T193858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c974e6ebc58fbe06040ebead585eca69af80fca714b07667fe34d21e4312a2ba
MD5 362404879c91b4ea867463e3e516581a
SHA1 5b8af0a3b5f4f4e8e1e7c53f4301d51c02d15e01
SHA512 80a22cbc1020bada981f1a10322298582af198b47da0bf5d7bc78ad13fe2277eef81bd71694d35d861ec11def98153f6ed31ed7f6722fed84ce34b2fa0e94a63
SSDEEP 24576:IAFs06+Omlf3NXEbTozyxknw4FYnshx8OfVe247:NFs060lVXubx4x8EVep
TLSH
T14365AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 06d9e85aa72eb98720079629691d35c6ca27406e0c4535f0682373cb0ef2fc33
MD5 b2f13210e91889d82d90c2808145863b
SHA1 af70aeb6543a7dd2bfdb9f5eec43fbc9a43d3fc4
SHA512 eb8e226e8c4b172ffc3083cf3f07a1d68f3847ace101934e8be7fa615b05f34103bc0d2eb0e272a7d8b76aaa529b957f3f48d944b5cb337ab4fe8e4392111529
SSDEEP 12288:VCJnJ5D3Vkr8zxN4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MJnJ5D3Wo4yxknw4FYnshx8OfVe247
TLSH
T1C885E03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0f256143b7b378602d22565de00d42ae1571ae2292149ed702105369c7cb2725
MD5 1a5381e18c65d9a012fb403f7201e317
SHA1 d742cad0b631f157690f86db0adfe76aa19e553a
SHA512 737617856a62e91ea6c2fa14a5d0f6de3eaadf5f31cb68c4fcc4ca137e9049b21405a5a82dbd4d079109181f272fca81710ede46f34b745751de6fce537f0566
SSDEEP 24576:AEPghm6/7IIXdwcXrif7qQncjlP65i3Vulyxknw4FYnshx8OfVe247:/g06DIKdwc+eQnSt65aVhx4x8EVep
TLSH
T191955C15B7EA5294E8B3CAB1CA62A1169B327C509B34F7DF0AC0C92E1D33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 5ae22487a20cbb1cdc2094b810c11c70190eb843c3a340eaa50172b2383b38c6
MD5 77e684ffb60dc9975179e7b84eb8cd97
SHA1 c9e274f4efe93faccbb2fcd919c44fa389084113
SHA512 123a6cf332d3600bd7589ce0ee311519b50c4407021c62b83205f05dd033cd947b6cb20d86b227571916a6a0939352721cb58a1a888e25a8ae2e60707752acfd
SSDEEP 12288:gEP3RMd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Mdyxknw4FYnshx8OfVe247
TLSH
T1F165126C67DD70E1E52A503A86A18205D372F0706B7263EF87A5D23E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 6c621983bbc89207e263a5f35368655b2974ecd20b98c099770ed708f08e2a92
MD5 f2c915dc7e9c90efa81b5d27e3f0a0f7
SHA1 fe370b554af3efec60949e73cb463affcb05ab10
SHA512 22bd308829cd2563e6ffa342e1d9af65c0d45b3906c80a34c24aa018c3948ae656a3079075af5fc3140b412ad5f722a51c399acb5ab193afd7f842ce6db7de02
SSDEEP 12288:Djkyw4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DIydyxknw4FYnshx8OfVe247
TLSH
T1D275121C63D8A0D1E57905369A7352A19A35BC709F3193DFD290F23EAE71DD0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 290ccf78d67b1e1d921a7aa7f6b8f60ad816c32236d8adf42c88dcd19281f03e
MD5 c453d82002ee7217a342f460723b5c21
SHA1 3da066f3aa2b646e785aa69ef9796c81a7f95d6c
SHA512 c9d093ea98a0678d6404f4bbddd31d69691f595f3f1d7b92d4d46cf05af69298cf8a1a9eb7b1e807d242d606335dba77c8562b241a56709ca5cf338e4fcac0da
SSDEEP 12288:jGO4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qvyxknw4FYnshx8OfVe247
TLSH
T10765237C67EAB4D1E91911730A3163626215B1B4AB7191EFC6F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 27b1c80b2497dcaa78e2d1d40bd550c160fc6568171af0602bfc00eb9a482308
MD5 da759b274fe4df0683bea9ab97be1544
SHA1 13bafc87178f4ee37766cdd257eed280aa55f51d
SHA512 97dfebe412b61cdc453f41b9e6029365a2e13ad37b67c03714952c91684c9ca1c4c6741d087cd34c0df85e27d92e94f577dd2e65fbeb0690e768b8d38a8f1ac5
SSDEEP 24576:OQ9MxZKdcz9dw3qyxknw4FYnshx8OfVe247:OVKZFx4x8EVep
TLSH
T166558C2DABE905DAE177D27595B250C3A633B4301B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 23f1afd430ac0eb12aa68035693962c1fe7b00b4253e7d98bcf856bba82510fd
MD5 2a6e4e186fd7c20f36c6452b25caa9ae
SHA1 9cad30a2c63764c220f8b50fd530e6acc02d6c24
SHA512 1c37f5ffa6365f13de0a743bb5dac9a911e3ced3e4d9ce70f914d739ef1f17b534b5317d4f996aa2983819dfd39d6d958b8f3f1b43483c8e478f39a0896cde42
SSDEEP 12288:FyoKo2SRple9pE4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FyocgApRyxknw4FYnshx8OfVe247
TLSH
T16F75E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ff12f9070e6451e62c804d8e9ea80dddb112989463fbd49c8c30b352321b9fb9
MD5 9b29e6476ff5c75d5f17245864e7622f
SHA1 35c6409e9611a9e318c2038fecaa6d8369ee7360
SHA512 8a0f731351c58b21b6186ebd9258a8c13de678180c325f1f96526f1fb9bdd3039b285106b04f6df416c8060aac15c100187e5d2ff0bf5acc9101873a370e9330
SSDEEP 49152:mWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKUx4x8EVep:w0zuNIOix8EVy
TLSH
T1F9A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f04dd42fbbf22be147feff594209c11e446e5f5c35d2ceda8579881b632d81e2
MD5 ef249b105e03dc95c2d43788685b6aa1
SHA1 664a84f0076ab94d50b79419d3339d6eb5c61e3a
SHA512 b8d2ff30c1e3842c9d3f703e6215a91468c2fea254091f438a25f356481e26d57e0cd901748ea009da01d056310ae9e910e5bd79045e3e8eaf79f92d211755b0
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYtjMqbdyxknw4FYnshx8OfVe247:rTDxR+N5YzTfjMJx4x8EVep
TLSH
T15A55B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-283-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/396-377-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/964-449-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/964-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1176-285-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1176-286-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1176-408-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1176-292-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1208-334-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1208-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1208-412-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1672-415-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/1672-305-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/1672-297-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/1672-303-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/1760-75-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1760-238-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1760-81-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1760-83-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/2136-42-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2136-236-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2136-36-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2136-46-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2916-319-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2916-498-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3052-275-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3052-327-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3192-2-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3192-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3192-33-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3192-32-0x0000000140000000-0x00000001401E5000-memory.dmp

Download

memory/3192-0-0x0000000140000000-0x00000001401E5000-memory.dmp

Download

memory/3212-501-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3212-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3496-90-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3496-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3512-266-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/3512-322-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3512-271-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/3512-265-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4004-314-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4004-247-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4124-418-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-445-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-442-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-440-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-439-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-437-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-426-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-425-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-444-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-436-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-435-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-451-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-450-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-448-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-456-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-455-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-454-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-453-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-452-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-441-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-446-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-434-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-433-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-447-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-423-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-438-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-424-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-417-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-443-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-419-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-422-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-421-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-420-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-432-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-431-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-430-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-429-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-428-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4124-427-0x000001B30B940000-0x000001B30B950000-memory.dmp

Download

memory/4180-316-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4188-255-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4188-251-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4188-261-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4188-318-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4296-231-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4296-13-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4416-502-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4416-328-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4428-416-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4428-308-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4452-235-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4452-25-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4452-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4452-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4464-68-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4464-66-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4464-73-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4464-71-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4464-60-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4488-410-0x000000000B3F0000-0x000000000B3F1000-memory.dmp

Download

memory/4488-338-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4488-375-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4488-358-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4488-342-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4488-409-0x000000000B400000-0x000000000B408000-memory.dmp

Download

memory/4488-413-0x000000000B3F0000-0x000000000B3F8000-memory.dmp

Download

memory/4488-503-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4572-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4572-58-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4572-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4572-237-0x0000000140000000-0x00000001402D4000-memory.dmp

Download